"Mawanella" worm sends political message

Hundreds of companies worldwide have fallen prey to another mass-mailing worm created by the virus toolkit that unleashed the AnnaKournikova worm, antivirus companies said Thursday.

Called Mawanella--the name of a Sri Lankan village--the worm carries a Sri Lankan political message, but does no real damage besides clogging networks with e-mail.

The worm has mainly affected companies in Australia and Europe, said Vincent Gullotto, director of the antivirus emergency response team at security company Network Associates.

"We got lots of reports coming in throughout Europe within a two- or three-hour period," he said. "While it's blasted Europe, it's been spotty in the U.S."

In total, Network Associates received more than 100 reports of virus infections from companies worldwide. Clients of Network Associates rival Symantec, the antivirus software maker, submitted a similar number of reports, Symantec said.

The worm comes attached to an e-mail message disguised as a note from a friend or colleague. When opened on a system with Microsoft Outlook installed, the attachment--Mawanella.vbs--sends a copy of itself to every entry in the address book.

After the mass mailing, the virus will bring up a dialog box with the message:

"Mawanella is one of the Sri Lanka's Muslim Village. This brutal incident happened here 2 Moslem Mosques & 100 Shops are burnt. I hat this incident, What about you? I can destroy your computer. I didn't do that because I am a peace-loving citizen."

The message appears on every Windows 9x, NT and 2000 machine infected by the virus, even if Outlook is not installed.

"It's one of the ones that is sociopolitical; I'm not sure if there has ever been one from Sri Lanka, but it's typical," said Vincent Weafer, director of Symantec's antivirus research center. "It is someone who wants to get a message out."

Though the worm has evaded detection through encryption, major antivirus companies now have new definitions available to update customers' antivirus software, and the worm is seemingly already on the ropes.

U.K.-based MessageLabs, which provides e-mail hosting services to more than 500,000 corporate customers, has detected nearly 1,000 copies of the Mawanella worm--far fewer than the almost 23,000 e-mails that hit the system in the first 24 hours when the Homepage worm struck.

"I do expect that this one will have a fairly short life," said Symantec's Weafer.