W32.Mypics.Worm.36352

W32.Mypics.Worm.36352 is a variant of the W32.Mypics.Worm. The worm propagates by automatically sending itself to as many as 50 people in the Outlook address book. The subject line is empty and the body of the email contains a worm installation program attachment named Mypics.exe. Mypics.exe extracts the files Mscomm32.ocx and Pictures.exe. Pictures.exe runs automatically and displays the following message:

YOU HAVE PICTURES WAITING IN YOUR OUTLOOK INBOX!

It is important to note that the worm has been written using Microsoft Visual BASIC. For the worm to run, the file Msvbvm50.dll (a Visual BASIC Virtual Machine run-time library) must reside on the computer. This file does not propagate with the worm, so if this file is not on the computer the worm does not function.

Protection

• Initial Rapid Release version May 11, 2000
• Latest Rapid Release version May 11, 2000
• Initial Daily Certified version May 11, 2000
• Latest Daily Certified version January 15, 2008 revision 017
• Initial Weekly Certified release date pending

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Moderate
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low