Telecom and Logistics Associates	Security NEWs Service: TLAnews
publication: Christian ALT	TLAalert    Security Service
Translate this page from:  English to French  English to German  English to Italian  English to Portuguese  English to Spanish	Save Time and Money

19.5.2000 Security: Symantec informs of a new worm Security software maker Symantec Corp. warned computer users and businesses of a new, destructive worm -- apparently based on ILOVEYOU -- that had hit three Israeli and European clients by Thursday night En français: Symantec nous informe d'un nouveau vers La société Symantec avertit les utilisateurs d'informatique et les entreprises d'un nouveau vers destructifs -- apparamment basé sur ILOVEYOU -- qui a atteint trois clients israeliens et européens dans la nuit de jeudi

For example, the worm might find the file "mydoc.txt" on the user's system and send off a message with the subject line "FW: mydoc.txt" and an attachment of "mydoc.txt.vbs".

The current variant also adds a twist found in other viruses: Polymorphism.

The worm adds a few characters to its script's comment lines, thereby changing the length and "fingerprint" by which most virus software recognizes the code for what it is. That feature could make the virus harder to stop.

Steps to stop it There are three ways to stop the virus, said Weafer.

First, the network administrator can block all e-mail containing VBS scripts.
Second, users of Outlook should download Microsoft's newest patch and turn off VBS scripts.
Finally, users can turn off the Windows Scripting Host in Windows 98 by using the Control Panel/Add-Remove Programs/Windows Settings Tab/Acessories and uncheck the element "Windows Scripting Host."

Technical description:

This polymorphic Loveletter variant will overwrite ALL files that are not currently in use regardless of extension. It arrives as an email message with a subject of "FW: FILENAME.EXT" and an attachment named "FILENAME.EXT.VBS" (where FILENAME.EXT is derived from the infected user's recently opened documents list.) If no documents have been used recently, this name is randomly generated. If the message has been generated by a system running Windows NT or Windows 2000, then the filename will be omitted and the subject of the message will be "FW: .EXT" and the attachment name will be ".EXT.VBS" (again, the file extension will vary depending on the recently opened documents list of infected machines.)

Removal:

The contents of all files will be replaced with the source code of the worm, thus destroying the original contents. The worm will also append the extension '.vbs' to each of these files. For example, the file calc.exe will become calc.exe.vbs. Since this worm overwrites all files regardless of extension, proper removal can only be achieved by restoring the affected files from known clean backups.

Some Consequences of the LoveLetter virus

At the Department of Defense, home to about one-third of the government's 6,300-plus most critical networks, "enormous efforts were expended containing and recovering from this virus

"Terrorists could use cyber-based tools and techniques to disrupt military operations, communications networks, and other information systems or networks."

The Department of Health and Human Services took as long as six days to restore full email services after being swamped with some three million messages.

At least 1,000 files at the National Aeronautics and Space Administration were damaged, and not all could be restored.

Recovery at the Labor Department required more than 1,600 employee hours and more than 1,200 outside contractor hours.

All information provided is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act upon such information without appropriate professional advice after a thorough examination of the facts of the particular situation.