Dangerous Love Bug variant seen

ITworld.com –

UPDATE A new variant on the Love Bug email virus comes as a "FWD" document that is able to automatically alter its subject title. It carries a dangerous attachment with a ".vbs" extender. The new virus is being called the VBS.NewLove.A virus, described as a "polymorphic" bug because of its ability to change its subject title.

While this latest, malicious Visual Basic script appears to be more sophisticated in some ways than the Love Bug, it is similar enough that many defenses put in place to stop the previous virus could also help forestall VBS.NewLove.A's spread.

The bug has been reported by antivirus concerns Trend Micro and Symantec, among others. Trend Micro said the bug is much more dangerous than the Love Bug, because it goes through all directories and replaces all existing files with files that are zero bytes in length. Both Trend Micro and Symantec have issued information and patches for the bug.

While the new bug is genuine, reports of its spread have been somewhat restricted to date. Early on Friday, the Pittsburgh-based Computer Emergency Response Team (CERT) said it had received no direct reports of infections related to this virus. In contrast, when the Love Bug attacked, by early on the afternoon of the first day CERT had received reports that more than 300,000 computers at 250 sites had been affected.

Mary Landesman, product analyst with Command Software Systems Inc., Juniper, Fla., said sightings of VBS.NewLove.A have been "fairly limited."

"Defenses have been helped by the fact that, coming so soon after 'Love Bug', people are aware of the threat of .vbs attachments," she said. As of early Friday morning, Landesman had seen the virus but not had reports from customers of trouble from the virus.

"It does happen to be quite malicious," she added. "It tries to replace all files on users' machines. This is more of a search-and-destroy virus. It's not trying to steal passwords."

In some ways, the virus is decidedly more complex than the earlier bug that called itself "Love." "It certainly is more complicated," said Command's Landesman. "It has randomly generated lines of text that are inserted each time it is sent. Essentially this gives it polymorphic capabilities." This, of course, helps it avoid detection when users casually view their email slate.

The random-line generator also causes the file to continuously grow in size as it is sent throughout the globe. "Eventually, the attachment is going to be large enough that it will certainly alert IT personnel," said Landesman, "It is certainly going to slow down servers 'if the size of the attachment grows'."

Landesman said that, besides regularly updated antivirus software on the desktop, content-filtering gateways on the front end are proving a helpful means of alerting administrators to incursions by malicious code such as VBS.NewLove.A. "You can cause these filters to stop all .vbs files from entering. This has probably helped limit the spread of this bug," she noted.

The earlier Love Bug, or Love Letter computer worm, was apparently launched by youths in the Philippines. It has been gauged as the most expensive and most damaging virus in history, according to some published estimates. While Philippine authorities have questioned individuals in the case, no one has yet been charged. In fact, the incident has come to be seen in some quarters as a showcase revealing the sophistication of that Asian country's programming community.

In a statement, the FBI said it has opened an investigation into reported VBS.NewLove.A activity. Landesman of Command Software said there were no clear indications in the bug script that this was the work of Filipino hackers.

Includes reporting by Jack Vaughan, ITworld.com, and material from IDG News Service.

ITWorld DealPost: The best in tech deals and discounts.
Shop Tech Products at Amazon