New ILOVEYOU Variant Not So Nice

A new virus, apparently based on the ILOVEYOU worm that struck the world a few weeks ago, has been discovered by Symantec. This new virus does not just overwrite .jpg and .mp3 files, it deletes every single file on the infected computer via setting the file length to 0. But it does not stop there, after spreading itself in the same manner as the ILOVEYOU virus, this one also destroys any mapped network drive.

The virus sends itself through e-mail with a subject-line of FW: followed by a random file name. The attached file has the random name and is followed by the .vbs extension.

Experts say this virus could be harder to stop due to its ability to add a few lines to the comment code, thus changing its fingerprint, which anti-virus software uses to recognize the virus and eliminate it.

It is recommended that system administrators block all e-mails containing VBS scripts and users install the latest Microsoft patch and turn off VBS scripting. Windows 98 users can turn off VBS Script Hosting via the Add/Remove Programs Control Panel.