Oslo, 22 March 2002  

Norman ASA, a world leader in the field of data security today announced that a potentially dangerous e-mail worm is reported in the wild.

The W32/MyLife.B worm, is an email worm that sends itself to all users in the Outlook address book. This is an email worm, written in Visual Basic and compressed using UPX. When run, it will display a small caricature of Bill Clinton, copy itself to the Windows System directory, and email itself out.

The worm also contains obvious code to delete files of type *.SYS, *.VXD, *.OCX and *.NLS and all files on the C:, D:, E: and F: drives. This payload has not yet been reproduced in the lab, but we are still working to uncover the trigger.

Notable is the false information included in the mail body of the worm, claiming that the file has been scanned by anti virus software with No Viruse (sic!) Found.

General characteristics

Type: Worm Alias: W32/Cari.A, W32/Caric.A Spreading mechanism: Email

Email characteristics:

Subject: bill caricature

Body:

Hiiiii How are youuuuuuuu? look to bill caricature it's vvvery verrrry ffffunny :-) :-) i promise you will love it? ok buy ========No Viruse Found======== MCAFEE.COM ------------------------------- Attachment: cari.scr

Destructivity:

Medium

Payload:

File deletion

Norman Virus Control with definitions files from March 22nd 2002 or later detects this worm. Users are encouraged to update their Norman Virus Control protection to the most recent version. For detailed Information about this threat visit: www.norman.com

For further information, please contact

Norman ASA, VP Marketing Bjørn A. Windfeldt, tel.+47 67 10 97 76, mob. +47 41 53 97 76