Copy Link
Add to Bookmark
Report
Net-Sec Issue 013
Net-Sec mini letter
Issue 13 - 20.05.2000
http://net-security.org
For any feedback or comments, mail staff@net-security.org
"New Love" is a new Visual Basic Script worm with a very damaging payload. Once executed, it tries to spam itself to all users in the Microsoft Outlook address book. When the worm is first run it drops a copy of itself in the Windows folder as either a name from the Recent Documents folder or a random Name and has a random extension chosen from Doc, Xls, Mdb, Bmp, Mp3, Txt, Jpg, Gif, Mov, Url, Htm, Txt and the real extension, ".vbs" The worm will modify that copy by adding random comments to its body. AV companies say that it is not spread around on the Internet (at least not yet).
Information from Anti-Virus companies.
Trend Micro (www.antivirus.com)
Name: VBS_NEWLOVE.A
More information: http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VName=VBS_NEWLOVE.A
Latest virus pattern: http://pattern.download.antivirus.com/ftp/products/pattern/lpt708.zip
AVP (www.avp.ch)
Name: I-Worm.NewLove
More information: http://www.avp.ch/avpve/worms/newlove.stm
Latest virus pattern: http://www.avp.ch/E/updates.htm
Sophos (www.sophos.com)
Name: VBS/NewLove-A
More information: http://www.sophos.com/virusinfo/analyses/vbsnewlovea.html
Latest virus pattern: http://www.sophos.com/downloads/ide/newlovea.ide
NAI (www.avertlabs.com)
Name: VBS/Newlove.a
More information: http://vil.nai.com/villib/dispvirus.asp?virus_k=98655
Latest virus pattern: http://download.nai.com/products/Mcafee-Avert/newlv4.zip
F-Secure (www.f-secure.com)
Name: VBS/Newlove.a
More information: http://www.f-secure.com/v-descs/newlove.htm
Latest virus pattern: http://www.f-secure.com/download-purchase/updates.html
FInjan Software (www.finjan.com)
Advisory: http://www.finjan.com/attack_release_detail.cfm?attack_release_id=37
Media outlets produced literally tons of articles about "New Love" worm:
NewLove proves less costly
http://www.cnnfn.com/2000/05/19/technology/virus/
New Love Virus Slow To Spread
http://www.crn.com/dailies/digest/breakingnews.asp?ArticleID=16786
New virus hits computers
http://news.ft.com/ft/gx.cgi/ftc?pagename=View&c=Article&cid=FT3ACD94G8C&live=true&tagid=ZZZC00L1B0C&subheading=information%20technology
Deadlier virus does limited damage in aftermath of 'Love bug'
http://news.cnet.com/news/0-1005-200-1902621.html?tag=st.ne.1430735..ni
A New Virus Appears, Some Question the Fear
http://dailynews.yahoo.com/h/nm/20000519/tc/tech_virus_2.html
'New Love' Virus Spawns Net Security Questions
http://www.thestandard.com/article/display/0,1151,15306,00.html
The Virus 'Ambulance Chasers'
http://www.wired.com/news/technology/0,1282,36464,00.html
"New Love" Threat
http://www.nandotimes.com/technology/story/0,1643,500206111-500287071-501549577-0,00.html
Network Associates downgrades "NewLove" threat
http://news.cnet.com/news/0-1005-200-1903744.html?tag=st.ne.1430735..ni
New Virus Shows Little Impact
http://www.pcworld.com/pcwtoday/article/0,1510,16819,00.html
Hacker Rails Against New Worm
http://www.wired.com/news/technology/0,1282,36477,00.html
New virus won't infect Macs
http://www.idg.net/ic_179263_1794_9-10000.html
Computer Associates Warns of New `Love Bug' Virus (Update2)
http://quote.bloomberg.com/fgcgi.cgi?ptitle=Technology%20News&s1=blk&tp=ad_topright_tech&T=markets_fgcgi_content99.ht&s2=blk&bt=ad_bottom_tech&s=AOSTy7hSiQ29tcHV0
Virus 'worse than Love Bug' on the loose
http://www.vnunet.com/News/1101596
First British companies report NewLove virus
http://www.zdnet.co.uk/news/2000/19/ns-15473.html
Chameleon-like Virus Hits Internet
http://www.apbnews.com/newscenter/internetcrime/2000/05/19/lovebug0519a_01.html
New virus more vicious than Love Bug
http://www.out-law.com/php/page.php3?page_id=newvirusmorevicio958745671
New Love: A Whole Lot of Nothing?
http://www.wired.com/news/technology/0,1282,36455,00.html
HNS staff
staff@net-security.org
