Internet vandals create new Love Bug variant

Fails to cause much harm

A variant of the infamous Love Bug has appeared on the Internet showing that computer vandals and virus writers are still trying to adapt old code in fresh attacks.

However the outbreak of the worm, which has been christened Myba by Russian antivirus firm Kaspresky Lab, has been contained so that it doesn't pose a particularly high risk for computer users. In fact the bug is mainly interesting for the techniques used by virus writers in attempting to disguise its content from anti-virus software.

Alex Shipp, senior anti-virus technologist at MessageLabs, which scans customers email for malicious code, said it had only intercepted two copies of Myba, both from the Philippines, where the Love Bug itself originated.

"What seems to have happened here is that someone took the source code for the Love Bug imported it into a Visual Basic editor and made a few changes so it could be compiled as a .exe file," said Shipp, who added the variant was detected with existing anti-virus software.

Myba spreads via email messages containing the infected attached file mybabypic.exe. When the attached file is run the worm registers itself in the system and distributes copies of itself to all email addresses found in a users' Microsoft Outlook address book.

The worm carries a destructive payload which attempts to corrupt data files and toggle Num Lock, Caps Lock and Scroll Lock keys.

Antivirus vendors are updating virus definition files to make sure the bug is detected and email users can also take steps themselves to make sure they're protected from this kind of malicious code. ®

Outlook Express users can stop viruses like Love Bug (including its variants) and the Anna Kournikova worm dead in their tracks with a few simple steps:
1. Go to "Tools", then "Options".
2. Click the "Security" tab.
3. Select "Restricted Zone" and click OK.