Continued virus alert

Louis Proyect lnp3 at SPAMpanix.com
Fri May 5 11:03:19 MDT 2000


www.computerworld.com

Virus still showing lots of "Love"

By Kathleen Ohlson

05/05/2000 The "ILOVEYOU" virus is becoming like a persistent ex-paramour -
it keeps coming back for another try.

The so-called LoveLetter Worm, which exploded onto desktops yesterday, is
now showing up in several different forms, according to the Federal Bureau
of Investigation, anti-virus watch groups and security software vendors.

"This makes Melissa look tame," said Eric Hemmindinger, an analyst at
Boston-based Aberdeen Group Inc., referring to a widely publicized e-mail
worm that appeared last year.

Melissa spread fast, clogged e-mail and was seen as a nuisance,
Hemmindinger said. But the LoveLetter worm "has all of this plus it
self-replicates, and the nasty thing is it infects files," he said.

According to Network Associates Inc., a security vendor in Santa Clara,
Calif., there are now five variants being spread around via e-mail. By
Monday, one or two more may appear from copycats, Hemmindinger said.

Central Command Inc.'s Emergency Virus Response Team (EVRT) today reported
the variants are spreading just as fast as the original I-Worm.LoveLetter
worm. The subject lines of the known versions of the worm include:

Subject: ILOVEYOU

Subject: Susitikim shi vakara kavos puodukui ...

Subject: fwd: Joke

Jeff Carpenter, a senior Internet security technologist at the Computer
Emergency Response Team's (CERT) Coordination Center in Pittsburgh, this
morning said the variants have different message content and attachment
names than the original virus that burst into the world's computers
yesterday.

According to Central Command, a Medina, Ohio-based anti-virus vendor, an
estimated 2.5 million PC users in the U.S. alone have been hit by the Love
worm or its counterparts.

Carpenter said CERT has received "several hundred reports" from industry,
government, academic institutions and home users indicating that more than
600,000 computers have been infected by the worm. CERT bases its figures on
direct reports that it receives from users, and Carpenter said the actual
number of infected PCs is probably much higher.

The Love worm is rejecting users in the form of an e-mail message with an
attachment called "LOVE-LETTER-FOR-YOU.TXT.VBS." The ".vbs" extension may
not appear on a default Windows system, which could lead users to believe
the attachment is a harmless text file.

But once the attachment is opened, the worm uses Microsoft Outlook - if
it's installed - to send the message to everyone in the infected user's
address book. The worm can also propagate through a Windows-based Internet
Relay Chat client called MIRC if that program is installed, security
experts said.

As a result, e-mail servers suffer overloads and more personal files and
files stored in shared directories on a victim's PC are overwritten by the
virus.

And now the FBI is getting involved, launching an investigation into the
Love worm's origination.

The government agency's National Infrastructure Protection Center (NIPC)
said the worm has been reported in at least 20 countries. It also warned
that the LoveLetter can capture affected caches and transfer this
information to a third party.

Aberdeen's Hemmindinger said the LoveLetter worm has "a much nastier
payload" than Melissa did, but he added that users in the U.S. may not be
impacted as badly this time around because of their experiences with
Melissa last year.

However, companies may have to suffer the same kind of lost time and
decreased worker productivity that they did a year ago because of the need
to shut down e-mail systems to eradicate the worm, Hemmindinger said.


Louis Proyect

(The Marxism mailing list: http://www.marxmail.org)





More information about the Marxism mailing list