Originally created 05/20/00

New computer virus crops up



NEW YORK - A computer virus using the same mechanism as the "Love Bug" has started spreading and is much more destructive than its predecessor, experts said Thursday.

Computers at several large companies were infected late Thursday, said Dave Perry, spokesman at anti-virus software company Trend Micro Inc., in Cupertino, Calif. One company had all of its 5,000 computers infected, said Perry, who wouldn't identify the companies.

Initial reports indicated that the virus was a variant of the "Love Bug" but Anita Chen, a Trend Micro spokeswoman, said the latest bug, while using the same method, has a different source code.

It also has a different "payload," Chen said, meaning it does something different once it infects a computer.

Like the "Love Bug" scourge that spread to millions of computers two weeks ago, the new virus arrives in an attachment to an e-mail. However, it isn't given away by an "ILOVEYOU" subject line. Instead, the subject line changes to a random word or phrase every time a computer is infected.

"Each time the virus spreads, it mutates itself to evade detection," Symantec Corp., another anti-virus software maker, said in a statement from its Cupertino offices.

The subject line of an infected e-mail starts with "FW:" and includes the name of a randomly chosen attachment from a previous e-mail on an infected computer. The e-mail will have an attachment with the same name, but ending in ".vbs."

Clicking on the attachment will activate the virus. Like "Love Bug," it will send itself to everybody in the user's address book. It will then destroy most of the files on the hard drive, rendering the computer useless until the operating system is reinstalled.

As with the "Love Bug," the virus spreads through Microsoft's Outlook e-mail program for Windows and there's no danger if the attachment is not opened, virus experts said.

The larger size of this virus's attachments are more likely to crash e-mail servers, experts said. The "Love Bug" had a small attachment, but crashed e-mail servers all over the world when it sent millions of copies of itself through the systems at once.

Perry said he hoped that increased awareness among e-mail users would hold back the spread of the new virus.

"Any time a virus hits a week after another virus its potency is diminished," he said. "People tend to be a little more cautious."

Investigators suspect the "Love Bug" originated in the Philippines, where several people have been questioned. The relatively simple virus was followed some hours later by copycat viruses posing as jokes or confirmations on Mother's Day gifts. None of those variants were very widespread.

Microsoft has said it will make available a modification to Outlook next week that will warn users about suspect e-mail attachments.

On the Net:

Trend Micro: http://www.antivirus.com

Symantec: http://www.symantec.com

Microsoft Office Update: http://officeupdate.microsoft.com