New strain of virus hits computer e-mail
|
||
In this story: Virus changes subject and copy on each infection |
SANTA CLARA, California (CNN) -- A new strain of computer virus written in the same computer programming language as the "Love Bug" virus has struck several U.S.-based multinational companies, according to computer experts.
The new strain is called "VBS/NewLove.a," by McAfee, an anti-virus firm. At one company, 5,000 computers were infected, according to Dave Perry, spokesman at the anti-virus software company Trend Micro Inc. in Cupertino, California.
The virus apparently began spreading on Thursday. Some virus experts say it could be more dangerous than the "Love Bug" virus, if it becomes widespread.
Early Friday, anti-virus experts were watching to see whether companies in Asia are affected.
Some computer experts advise home and individual Microsoft Outlook users not to open forwarded messages containing attachments.
Eddy Hsia, director of engineering for McAfee, in Santa Clara, California, told CNN that his company had issued a "high threat" warning about the virus.
He said VBS/NewLove.a "could easily cause rampant damage" and would not necessarily be detected by the same anti-virus devices that caught "Love Bug."
Hsia said McAfee updated its detection equipment on Thursday, within two hours of detecting the new virus, and he urged companies to update their virus scanners as soon as possible.
He said new attachments to an e-mail -- the way in which the virus arrives -- should not be opened, especially if they are from people who have not been heard from for a while.
Hsia said it is too early to detect the source of the new strain.
Virus changes subject and copy on each infection
The VBS/NewLove.a virus, or worm, spreads when a user opens an attachment in Microsoft Outlook e-mail. The subject line of an infected e-mail starts with "FW:" and includes the name of a randomly chosen attachment from a previous e-mail on an infected computer.
The infected e-mail has an attachment with the same name, but ending in ".vbs." VBS stands for VisualBasic, the programming language in which it is written. "Love Bug," too, was written in VisualBasic.
Like "Love Bug" the virus can send itself to everybody in the user's address book. In that case, it can destroy most of the files on the hard drive, rendering the computer useless until the operating system is reinstalled.
The worm not only changes its message subject each time it infects, but each copy of the message is different from every other copy.
This is achieved, according to ICSA.net, part of the GartnerGroup of Companies based in Stamford, Connecticut, because "the worm uses a space-algorithm to pad comment lines in the VBS (Visual Basic Script) code, causing copies of the worm to lack identity with their progeny and siblings."
ICSA advises corporations and organizations to disable e-mail gateways until 3-mail containing .vbs attachments can be effectively filtered and quarantined.
Recovering deleted files
Home and individual users of Microsoft Outlook should not open forwarded messages containing attachments of any type, ICSA says.
With regard to recovering deleted files, ICSA says it will be very difficult. The infected files are overwritten by the virus and are recoverable only by restoration from backup.
Anti-virus companies are hoping that increased awareness prompted by the "Love Bug" will temper the spread of the new strain.
"Any time a virus hits a week after another virus its potency is diminished," said Perry. "People tend to be a little more cautious."
The "Love Bug" virus -- a strain different from the new and potentially even more destructive worm -- spawned at least 25 copycats with varying levels of destructiveness. Computer Economics, a Carlsbad, California-based research company, estimated that "Love Bug" and its variants caused $6.7 billion of damage.
The virus forced many businesses and government agencies -- from the Pentagon to Britain's Parliament to major companies such as Ford and Lucent -- to take down computer networks for protection and repair.
The Associated Press contributed to this report.
digg it
del.icio.us