New E-Mail Worm Spreads Trouble, Adult Humor

February 28, 2001

A new ILOVEYOU-style worm called "MyBabyPic" has begun landing in e-mail inboxes around the world, but users shouldn't be fooled by its seemingly harmless nature, virus experts warned.

The worm, which first appeared early Tuesday, arrives carrying an attached file, MYBABYPIC.EXE, that's written in Visual Basic. The e-mail carrying the infected attachment bears a subject line that says "My baby pic!!!," and says "Its my animated baby picture!!" in the body of the message.

Users who open the file will see what appears to be a cartoon of a baby with decidedly adult anatomical features. Worse, however, is the fact that opening the file will trigger a torrent of e-mail, experts at McAfee warned Wednesday.

"This binary attachment will display an animated graphic, one of a baby in a baby crib with an adult-sized penis," according to a warning posted on the McAfee Web site.

Humor Gone Wrong

Experts fear that the humorous -- and graphic -- nature of the cartoon might encourage some recipients to forward the e-mail to others, as they would with any other funny e-mail.

When the attachment is opened, the worm copies itself to the recipient's local file system and sends an e-mail attachment to each MS Outlook user in the recipient's address book within about 10 minutes after the worm is downloaded, McAfee said.

The virus also creates a series of files and registers them to run in the startup section of Windows, which executes the file each time the computer is turned on.

Outlook At Risk

"It is written to trick a user into thinking it is a joke, [but] runs as a process after the user thinks the program has been closed, and sends [itself] to others using Outlook," McAfee said. "An email message is sent to each user listed in the available address books approximately 10 minutes after first running this virus."

Security experts also said that although MS Outlook spreads the worm, e-mail addresses on other systems receiving the message will not automatically pass it along to other users.

Files Threatened

British anti-virus firm Kaspersky Lab said the worm carries a "very dangerous payload" that can easily wipe out the data on a computer. Depending upon when the virus is received, the worm can activate and deactivate the NumLock, CapLock, ScrollLock keys; can send the message ".IM _ BESIDES _ YOU _" to the keyboard buffers; and may send one of several text messages.

Those messages include, "FROM BUGGER," "HAPPY VALENTINES DAY FROM BUGGER," and "HAPPY HALLOWEEN FROM BUGGER," the company said.

The virus also corrupts files with the following extensions: VBS, VBE, JS, JSE, CSS, WSH, SCT, HTA, PBL, CPP, PAS, C, H, JPG, JPEG, MP2, and MP3, according to the company.