Oslo, 2 April 2002  

Norman ASA, a world leader in the field of data security today announced that a new version of the MyLife worm is reported in the wild. The worm will attempt to format all drives from D: through I:, and attempt to delete all files on drive C: depending on a time trigger.

This is a new variant in the MyLife series of email worms. The W32/MyLife.F worm, sends itself to users picked from the Outlook Address book and the MSN Messenger contact list. It will install itself in the registry in order to be started during bootup.

Notable is the false information included in the mail body of the worm, claiming that the file has been scanned by anti virus software with No Viruse (sic!) Found.

General characteristics

Type: Worm Spreading mechanism: Email

Email characteristics

Subject: the list

Body:

Hiiiii How are youuuuuuuu? look to the notepad it's vvvery verrrry ffffunny :-) :-) i promise you will love it :-) Notepad = list list = 37 buyyyy ========No Viruse Found======== MCAFEE.COM --------------------------------------------------------

Attachment: List480.TXT.scr

Destructivity

High

Payload

Formats disks, deletes files

Norman Virus Control with definitions files from April 2nd or later detects this worm, as well as variants C, D and E of the same worm. Users are encouraged to update their Norman Virus Control protection to the most recent version. For detailed Information about this threat visit: www.norman.com

For further information, please contact

Norman ASA, VP Marketing Bjørn A. Windfeldt, tel.+47 67 10 97 76, mob. +47 41 53 97 76