CA Warns Of Lucky2000 Visual Basic Virus

Computer Associates International Inc. [NYSE:CA] today
warned computer users of yet another virus that's been released
into the wild in time for Y2K. The virus has been named "Lucky2000"
and it overwrites Visual Basic scripts.

According to Computer Associates, Lucky2000 runs on Windows 95,
Windows 98, and Windows NT platforms, if Visual Basic script is
installed, and infects all files in the current directory regardless
of their extensions. When a file is infected, the entire content of
the file is replaced with the virus body.

However, Computer Associates warns that the virus doesn't change
the original file names, therefore, it is not possible to determine
if the file has been infected from the name.

Newsbytes asked Computer Associates International Security Business
Manager Simon Perry how a PC user could know if their computer was
infected with the virus, or was experiencing some Y2K-related problem.

"Bottom line," Perry said, "it is hard to distinguish." But, Perry did
say that Lucky2000 contains a classic characteristic that indicates
that a computer has been effected by a virus rather than the
Millennium Bug.

Perry said that a classic virus indicator is a change in a
computer's default browser. Rather than opening to the default
browser's home page, a different home page will appear.

In the case of Lucky2000, it will display a message and create a
C:WINDOWSFavoritesLuucky2000.URL shortcut. Once the shortcut is
created, the computer will display the virus-related home page. In
the case of Lucky2000, that Web page is in Russia.

Perry explained that the reason so many viruses cause a computer
to go to a certain Web page is because virus creators like to
count hits.

More information from Computer Associates International is
available at http://www.cai.com.

Reported by Newsbytes.com, http://www.newsbytes.com.