 |
FBI: Probing New Virus More Dangerous Than Love Bug
FBI agents are investigating a new computer virus, potentially more destructive than the ILOVEYOU bug, that was spreading by email, officials said Friday.
The new virus is "polymorphic," meaning that it changes its subject line and program code every time it is transmitted, making it more difficult to detect, the US government's National Infrastructure Protection Center (NIPC) said.
Although early reports called the bug a variant of the ILOVEYOU virus, experts said later it was a new worm similar to the love bug.
Software companies labeled the new bug NewLove.VBS, but others were calling it "Herbie." Experts urged caution about opening email attachments, especially those marked with a VBS tag.
US Attorney General Janet Reno said the FBI had launched an investigation into the new worm, which is a virus that replicates itself.
Michael Vatis, director of the NIPC, said reports of the new attack were coming in from all over the country and it appeared the virus originated "at least in significant part in the United States rather than spreading from Asia to Europe to the United States."
Computer Associates, a software group, said the virus was "totally new" and may have originated in Israel.
The company said the virus "grows as it spreads, clogging a network with a large amount of email traffic, eventually bringing mail servers down."
Vatis said early reports indicated at least 1,000 computers had been infected by the virus.
Vatis said it was possible that some virus attacks are coming from organized groups, or even from foreign adversaries.
"As a general matter, we do see in many of these cases ... some organization, often online organizations," Vatis said.
"The spectrum of threats online does include organized criminal groups engaging in hacking or online extortion or things like that ... and the threat from foreign nation-states is also one that we are very mindful of."
Vatis said the new virus "propagates itself in the same way (as ILOVEYOU) but it disguises itself in a more sophisticated fashion, so that it's potentially more dangerous. It also has a greater capability to erase files on a system.
Anti-virus software group Symantec said the new variant carries "an extremely destructive payload."
"The virus randomly chooses a recently opened file from the Start/Document folder in the Microsoft Start menu and attaches it to the email as a .vbs file. Each time the virus spreads, it mutates itself to evade detection," Symantec said.
The virus also "sends a mutated version of itself to all addresses in the computer user's (Microsoft) Outlook address book causing mail servers to clog."
Additionally, the virus overwrites numerous files and renders the computer inoperable, software companies said.
"It carries an attachment which also picks up a random name, so there is nothing like the Love Bug to distinguish it," said Graham Cluley of the British anti-virus company Sophos. "The only way of spotting it is that the attachment ends 'Vbs.'
But experts said it did not appear to be spreading at the same rate as the original love letter.
"Isolated incidents of the virus have been reported in the US West Coast, Europe and Israel, but the virus does not appear to be spreading rapidly at this time," said Trend Micro, a Japanese-based anti-virus firm.
Some computer security experts had criticized Microsoft following the ILOVEYOU virus outbreak for failing to provide better security for the Outlook email program, which was used to propagate the virus.
Microsoft said this week it was issuing a "patch" to make the program more secure, but it was not expected to be available before Monday.
In This Section
|
