Main Page | Bracing for Cyberwar | Hacking Primer | Scenes from the 'Hacker Underground' | Hacking: Two Viewpoints | Timeline | Gallery | News Archive | Discussion | Related Sites

New strain of virus hits computer e-mail

May 19, 2000
Web posted at: 8:16 a.m. EDT (1216 GMT)

In this story: Virus changes subject and copy on each infection Recovering deleted files RELATED STORIES, SITES

SANTA CLARA, California (CNN) -- A new strain of computer virus written in the same computer programming language as the "Love Bug" virus has struck several U.S.-based multinational companies, according to computer experts.

The new strain is called "VBS/NewLove.a," by McAfee, an anti-virus firm. At one company, 5,000 computers were infected, according to Dave Perry, spokesman at the anti-virus software company Trend Micro Inc. in Cupertino, California.

The virus apparently began spreading on Thursday. Some virus experts say it could be more dangerous than the "Love Bug" virus, if it becomes widespread.

Early Friday, anti-virus experts were watching to see whether companies in Asia are affected.

ALSO Microsoft Outlook update impedes functionality, but enhances security Philippine student group notorious for hacking G8 agree to cooperate on cybercrime Global panel issues Internet security recommendations     MESSAGE BOARD   •  Insurgency   •  Managing the net   •  Internet society     Bracing for Cyberwar Hacking Primer Hacking: Two Views Timeline Gallery Discussion TIME: Counterhacking 101 Related Sites

Some computer experts advise home and individual Microsoft Outlook users not to open forwarded messages containing attachments.

Eddy Hsia, director of engineering for McAfee, in Santa Clara, California, told CNN that his company had issued a "high threat" warning about the virus.

He said VBS/NewLove.a "could easily cause rampant damage" and would not necessarily be detected by the same anti-virus devices that caught "Love Bug."

Hsia said McAfee updated its detection equipment on Thursday, within two hours of detecting the new virus, and he urged companies to update their virus scanners as soon as possible.

He said new attachments to an e-mail -- the way in which the virus arrives -- should not be opened, especially if they are from people who have not been heard from for a while.

Hsia said it is too early to detect the source of the new strain.

Virus changes subject and copy on each infection

The VBS/NewLove.a virus, or worm, spreads when a user opens an attachment in Microsoft Outlook e-mail. The subject line of an infected e-mail starts with "FW:" and includes the name of a randomly chosen attachment from a previous e-mail on an infected computer.

The infected e-mail has an attachment with the same name, but ending in ".vbs." VBS stands for VisualBasic, the programming language in which it is written. "Love Bug," too, was written in VisualBasic.

Like "Love Bug" the virus can send itself to everybody in the user's address book. In that case, it can destroy most of the files on the hard drive, rendering the computer useless until the operating system is reinstalled.

The worm not only changes its message subject each time it infects, but each copy of the message is different from every other copy.

This is achieved, according to ICSA.net, part of the GartnerGroup of Companies based in Stamford, Connecticut, because "the worm uses a space-algorithm to pad comment lines in the VBS (Visual Basic Script) code, causing copies of the worm to lack identity with their progeny and siblings."

ICSA advises corporations and organizations to disable e-mail gateways until 3-mail containing .vbs attachments can be effectively filtered and quarantined.

Recovering deleted files

Home and individual users of Microsoft Outlook should not open forwarded messages containing attachments of any type, ICSA says.

With regard to recovering deleted files, ICSA says it will be very difficult. The infected files are overwritten by the virus and are recoverable only by restoration from backup.

Anti-virus companies are hoping that increased awareness prompted by the "Love Bug" will temper the spread of the new strain.

"Any time a virus hits a week after another virus its potency is diminished," said Perry. "People tend to be a little more cautious."

The "Love Bug" virus -- a strain different from the new and potentially even more destructive worm -- spawned at least 25 copycats with varying levels of destructiveness. Computer Economics, a Carlsbad, California-based research company, estimated that "Love Bug" and its variants caused $6.7 billion of damage.

The virus forced many businesses and government agencies -- from the Pentagon to Britain's Parliament to major companies such as Ford and Lucent -- to take down computer networks for protection and repair.

The Associated Press contributed to this report.

Microsoft Outlook update impedes functionality, but enhances security
May 16, 2000
Investigator: Dropout may be admitting role in virus attack
May 12, 2000
Authorities seek to question pair in "Love Bug' attack
May 11, 2000
Hotmail, Yahoo scramble after email security flaws exposed
May 10, 2000
'Love bug' investigation turns to 2 computer school students in Philippines
May 10, 2000
Former computer student investigated in 'ILOVEYOU' attack
May 10, 2000

New e-mail virus may hurt worse than 'Love'
May 12, 2000
New e-mail virus may hurt worse than 'Love'
May 12, 2000
Security experts say hackers have the edge
May 11, 2000
Techniques and tools of the hacker
May 10, 2000

McAfee.com
  • Anti Virus - VBS/Newlove.a Help Center
ICSA.net
CERT¨ Coordination Center
  • CERT/CC Computer Virus Resources
F-Secure Web - Main index
   • Virus Info Center
BUGTRAQ: Introduction

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.