Security experts are scrambling to keep up with mutations of the "I Love You" virus that may evade earlier fixes, including a new variant that plays on the upcoming Mothers' Day holiday.
As earlier reported by CNET News.com, a version called "Very Funny" was among the first identified. But antivirus researchers say that at least eight different versions are rippling through the Net and warn that more are likely on the way.
"There's a big hacker community out there, and anyone could open up the script," said Steve Gottwals, senior product manager for security company F-Secure. "It's really easy to make a variant."
The most prevalent new form of the virus today is a variant called "Mothers' Day," antivirus companies say.
This version contains the words "Mothers Day Confirmation Order" in the subject line. The email informs readers that a $326.92 credit card charge was made for a Mothers' Day diamond special and directs them to print the attachment, allegedly an order invoice.
Computer users who click on the "invoice" will find their computers infected with a modified version of I Love You. But instead of attacking image and music files, as did the original, Mothers' Day overwrites ".bat" and ".ini" files needed to start the computer. That makes it potentially even more destructive than the original, researchers warned.
Most major virus companies
Variations on a virus The "Love" bug and eight of its variants spotted so far.
Version
Subject
Attachment name
Seen "in the wild"
a
I Love You
LOVE-LETTER- FOR-YOU.TXT. vbs
yes
b
Susitikim shi vakara kavos puodukui...*
LOVE-LETTER- FOR-YOU.TXT. vbs
yes
c
FWD: JOKE
VERYFUNNY. vbs
yes
d**
I Love You
LOVE-LETTER- FOR-YOU.TXT. vbs
yes
e
Mother's Day Order Confirmation
mothersday. vbs
no
f***
Dangerous Virus Warning
virus_warning. jpg.vbs
yes
g****
VIRUS ALERT!!!
protect.vbs
yes
h*****
A killer for VBS/LoveMail and VBS/Kak worm
viruskiller.vbs
yes
* Lithuanian for "Let's meet tonight for a cup of coffee." ** underlying code changed.
*** message body reads: "There is a dangerous virus circulating. Please click attached picture to view it and learn to avoid it."
**** message body begins: "Dear Symantec customer," and includes detailed explanation of the Love Letter virus. Variant targets some system files.
***** message body begins: "Start the attachment to clean all you (sic) files and hard discs (sic)." Source: McAfee and Symantec
have posted files on their Web sites that fix this version and the others that have been identified so far. Some companies are advising that people simply turn off the Windows feature that allows the viruses to work and are giving instructions on how to do so.
Several versions besides the Very Funny modification have popped up.
One version includes the words "Susitikim shi vakara kavos puodukui..." in the email's subject line, which F-Secure said translates to "Let's meet this evening for a cup of coffee..." in Lithuanian.
Others make tiny changes to the code of the virus that don't change its function but do allow it to slip past some of the antivirus filters.
"At least in some instances it seems tabs in the virus code have been changed to spaces," reported Security Focus' Elias Levy to the Bugtraq security mailing list. "That means the code looks the same, but it's not. Some antivirus products may be fooled by this."
The leading antivirus research houses have been working overtime to keep up with the different variants and post information and protection against the newcomers.
"I'm sure we'll see more variants," said Dan Schrader, antivirus researcher at Trend Micro. "The code is easily modified and easily spread."
The widespread Melissa virus outbreak followed a similar pattern, Schrader said. Melissa variants, some of them far more malicious than the original version, number in the 40s.
New patches began appearing yesterday, shortly after the Very Funny variant surfaced.
"It seems to be that someone has changed the name of the attachment and the subject line," said Nerender Mangalan, director of security strategy for Computer Associates. "Basically it's the exact same file, and it does the exact same thing, but it's renamed so people looking out for I Love You would open it."
Join the conversation
Comment replyThe posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.
Google creates an animated doodle that features a boy, a girl, Google's search engine, and a jump rope. But might there be darker, more analytical, more troubling interpretations to this tale?
The Silicon Valley online payments startup grew by 1,000 percent last year and is hopeful it can repeat that level of growth this year. To do that, it's had to move away from its early friends-and-family roots and embrace small businesses.
Chamtech's spray-on antenna uses a nano material to provide a low-power boost to antenna range. The wireless-in-a-can product may some day bring an end to unsightly cell towers.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
Join the conversation