August 17, 2000 9:15 AM PDT
New strain of "Love" virus steals passwords
- Related Stories
Virus war pits hackers against software armiesJuly 7, 2000
Sneaky new virus format has software makers scramblingJuly 7, 2000
When "Love" hits your "Resume" and it isn't so "Funny"June 21, 2000
Philippine ISP cooperating with FBI in virus probeMay 4, 2000
Microsoft slammed for email security holesMay 4, 2000
The virus, "VBS/LoveLetter.bd," first appeared yesterday in Europe; so far, it has only infected computers at banks in the region and a few locations in the United States, according to experts.
The National Infrastructure Protection Center today warned of the new variant and said infections had been reported at two U.S. banks.
"At this time, we haven't received any further reports other than the initial two, and since those two incidents focused on banking functions, that is the reason behind the action the NIPC took in issuing its warnings," NIPC spokeswoman Debbie Weirerman said.
Antivirus software company Computer Associates International said in a Web posting that at least two of its North American clients had reported infections.
Weirerman said she did not know whether the virus attack was specific to banks.
NIPC, which is the government agency charged with protecting the security of the nation's computing infrastructure, would not say which banks had been hit.
The virus appears to have first affected the United Bank of Switzerland's European operations. In a release today, the company said that only "a small proportion of UBS e-banking customers are at risk" and that "there are no reports of damage as of yet." The Swiss bank said it has installed virus filters that have "successfully prevented the virus from spreading within UBS."
The new strain downloads and runs a program, "hcheck.exe," that steals passwords from an infected computer. While the virus is at work, people see a résumé for "Knowledge Worker, Zurich," written in German.
While other I Love You variants have posed threats, protections put in place by large corporations and government agencies since the original outbreak have greatly curtailed new infections.
Symantec's Antivirus Research Center is warning computer users to be wary of email messages containing the attachment "resume.txt.vbs."
Like other Love Letter variants, the virus scans a person's Microsoft Outlook address book and attempts to send copies of the virus to all email addresses listed. Other email programs generally are not affected this way.
Infected files sent to Outlook addressees contain no subject lines or recipients, but the following email addresses appear in the BCC, or blind carbon copy, line: firstname.lastname@example.org, email@example.com, firstname.lastname@example.org.
The original I Love You outbreak was devastating, with damage estimates in the billions. While a Gallup poll found only one in 15 companies were infected by the original outbreak, damages mounted as companies shut down email systems and took other precautions to prevent the virus' spread.
Microsoft products are particularly vulnerable to this kind of virus attack because of their design, and the company has been sharply criticized for this.
Viruses such as I Love You and its variants use VBScript to execute commands affecting an infected system. Microsoft and most security experts warn computer users to be wary of email attachments, such as the "resume.txt.vbs" resume script, ending with the ".vbs" extension.
Because competing email products such as Qualcomm's Eudora Pro and even Microsoft's Outlook Express do not use VBScript, they generally are not vulnerable to this kind of attack. But Microsoft is introducing scripting capabilities to its Macintosh version of Office and an Outlook-like email client that could increase vulnerability in Office 2001, which will ship in October.
In the wake of the original Love Letter outbreak, Microsoft released a patch that changes Outlook's default security settings and makes it more difficult to launch ".vbs" attachments.