Monday, April 2, 2001		Article

This ‘Love Bug’ variant is more destructive

A new computer virus, said to be both smarter and more destructive than the worldwide "Love Bug" plague that inspired it, has surfaced but was not spreading rapidly today, according to Internet bug watchers.

The FBI’s top cyber investigator says the latest e-mail virus appears to have originated in the US. Michael Vatis says federal investigators first got word early this morning and began sending out alerts around 2 a.m. EDT. Vatis says it’s unclear how widespread the virus is. He says it’s more sinister than the Love Bug because it changes subject lines each time it’s re-sent, making it harder to protect against.

The CERT Coordination Centre, a government-chartered computer emergency team at Carnegie Mellon University, reported that as of 8 a.m. EDT, it had "received no direct reports of infections related to this virus."

While the "Love Bug" was given away by the "I LOVE YOU" subject line of the e-mails that carried it, the new virus changes subject lines every time it is sent. It also destroys most of the files on the computers it infects.

"Each time the virus spreads, it mutates itself to evade detection," according to Symantec Corp., an anti-virus software maker in Cupertino, Calif. The subject line of an infected e-mail starts with "FW": and includes the name of a randomly chosen attachment from a previous e-mail on an infected computer. The e-mail will have an attachment with the same name, but ending in ".vbs."

Clicking on the attachment will activate the virus. Like "Love Bug," sends itself to everyone in the user’s address book. It will then overwrite most files on the hard drive, rendering the computer useless until the operating system is reinstalled.

Alan Stevens, head of digital services at Britain’s Consumers Association, said the VBS extension was key to recognising and eliminating the virus. "You would not normally expect someone to send you an e-mail with a VBS extension. They are unusual, so they should be a dead giveaway to someone who knows what they are doing."

Simon Perry, vice-president of security solutions at US-based Computer Associates said the virus renamed all files on a computer’s local hard drive and associated network drives with a VBS (visual basic script) extension and set the file size to zero—effectively making the computer’s system and network inoperable.

The size of the virus’ attachments is more likely to crash e-mail servers, experts said. The "Love Bug" had a small attachment, but crashed e-mail servers all over the world when it sent millions of copies of itself through the systems at once.

So far, Microsoft’s Outlook is the only e-mail program the virus is attacking, said Anita Chen, a spokeswoman for Trend Micro. Microsoft has said it will next week make available a modification to Outlook that will warn users about suspect e-mail attachments.

The virus was detected at several large companies late Thursday, said Dave Perry, spokesman for another anti-virus software maker, Trend Micro Inc. in Cupertino. At one company, 5,000 computers were infected, Perry added and not identify any of the companies affected.

The "Love Bug" spreads like an avalanche to millions of computers two weeks ago. Estimates of the damages caused range up to $10 billion and investigators have questioned several persons in the Philippines during the search for the author.

The relatively simple "Love Bug" virus was followed some hours later by slightly modified variants, posing as jokes or confirmations on Mother’s Day gifts. None of the variants were very widespread.

Trend Micro’s Perry said he hoped that increased awareness among e-mail users would hold back the spread of the new virus. "Any time a virus hits a week after another virus, its potency is diminished," he said. "People tend to be a little more cautious."

This second threat to the world’s computer network in a matter of weeks may finally prompt concerted government action to fight a crime that ignores national borders and which is covered by few international treaties.

Germany’s interior minister, Otto Schily, said: "The new virus attack shows that such threats are not technical games but rather criminal actions which must be met with early counter-measures."