• Recommend:
• 0 Comments

Virus Spreads to New Digital Envelopes

Original Love Letters are coming under control, but virus is morphing into Mother's Day and other versions.

By Cameron Crouch, PCWorld   

The original virus is starting to come under control, say executives for antivirus vendor McAfee. But several copycat viruses emerged Wednesday and Thursday that operate similarly to the original Love Letter worm.

Experts urge e-mail users to beware of messages with the subject lines, "RE: Joke" and "Mother's Day Gift Confirmation", as well as a Lithuaninan strain with the subject line, "Susitikim shi vakara kavos puodukui...." All carry the same destructive load as the Love Letter message.

The Mother's Day version appears to have been born in the U.S., says Mikko Hypponen, manager of antivirus research at security software supplier F-Secure in Finland. The company received a sample Thursday from the U.S.

"Since the text in the message also refers to U.S. dollars, it certainly appears to be from America, but we have not confirmed that yet," Hypponen says.

The message field of the Mother's Day e-mail reads: "We have proceeded to charge your credit card for the amount of $326.92 for the mothers day diamond special. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place. Thanks Again and Have a Happy Mothers Day! mothersday@subdimension.com." The attached file is titled mothersday.vbs.

F-Secure and other vendors now recommend that computer users turn off a feature called Script Hosting that is one of the default settings in Microsoft's Internet Explorer browser. This prevents any VBScript worms such as the original Love Letter and its variants from affecting a system.

Virus Fighters Update Cures

"Our customers have been able to deploy cures to Love Letter and its variants," says Gene Hodges, president of the McAfee division at Network Associates.

Damages in the United States are estimated at $2.6 billion through Thursday, according to Computer Economics. That number could rise to $10 billion by next Tuesday, making Love Letter the worst worm ever. And the effects of Love Letter have been felt worldwide.

McAfee has reason to believe that the virus originated in Manila. "There is a user ID of spider@mail.com," Hodges says. "I wouldn't say we're dead sure it came from the Philippines but it did originate in the Far East."

Easily Spread

One reason for the worm's virulence: "It is craftily designed to spread itself," Hodges says.

The worm looks into your Outlook address book and sends itself to everyone listed there, and it also copies over widely distributed files such as .jpeg, .mp2, and .mp3 files, Hodges says.

The three named variants operate similarly and affect files in similar ways, he adds. But our worm worries may not be over, as McAfee has only just identified the possible new strains.

The virus affects only Windows systems, Hodges says. "It uses Windows scripting typically installed with Internet Explorer 5.0." None of the strains affect Macintosh, Linux, or Unix systems, Hodges says.

Better Prepared?

Corporate customers have gotten better at responding quickly since last year's Melissa virus, Hodges says.

McAfee offers a Web-based cleaning system for the virus at MyCIO.com, as well as a downloadable update to the McAfee antivirus scan software.

"Since yesterday, we've serviced over 1 million customers wordwide," says Srivats Sampath, McAfee.com's president and chief executive officer. "It's starting to get under control; people are becoming informed of the virus and the mechanisms to protect themselves from it."

IDG News Service contributed to this report.