Dangerous Love Bug variant seen

UPDATE A new variant on the Love Bug email virus comes as a "FWD"
document that is able to automatically alter its subject title. It carries a dangerous
attachment with a ".vbs" extender. The new virus is being called the VBS.NewLove.A
virus, described as a "polymorphic" bug because of its ability to change its subject
title.

While this latest, malicious Visual Basic script appears to be more sophisticated in
some ways than the Love Bug, it is similar enough that many defenses put in place to
stop the previous virus could also help forestall VBS.NewLove.A's spread.

The bug has been reported by antivirus concerns Trend Micro and Symantec, among
others.
Trend Micro said the bug is much more dangerous than the Love Bug, because it goes
through all directories and replaces all existing files with files that are zero bytes
in length. Both Trend Micro and Symantec have issued information and patches for the
bug.

While the new bug is genuine, reports of its spread have been somewhat restricted to
date. Early on Friday, the Pittsburgh-based Computer Emergency Response Team (CERT)
said it had received no direct reports of infections related to this virus. In
contrast, when the Love Bug attacked, by early on the afternoon of the first day CERT
had received reports that more than 300,000 computers at 250 sites had been affected.

Mary Landesman, product analyst with Command Software Systems Inc., Juniper, Fla.,
said sightings of VBS.NewLove.A have been "fairly limited."

"Defenses have been helped by the fact that, coming so soon after 'Love Bug', people
are aware of the threat of .vbs attachments," she said. As of early Friday morning,
Landesman had seen the virus but not had reports from customers of trouble from the
virus.

"It does happen to be quite malicious," she added. "It tries to replace all files on
users' machines. This is more of a search-and-destroy virus. It's not trying to steal
passwords."

In some ways, the virus is decidedly more complex than the earlier bug that called
itself "Love." "It certainly is more complicated," said Command's Landesman. "It has
randomly generated lines of text that are inserted each time it is sent. Essentially
this gives it polymorphic capabilities." This, of course, helps it avoid detection when
users casually view their email slate.

The random-line generator also causes the file to continuously grow in size as it is
sent throughout the globe. "Eventually, the attachment is going to be large enough that
it will certainly alert IT personnel," said Landesman, "It is certainly going to slow
down servers 'if the size of the attachment grows'."

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine