Network Associates AVERT Labs (Anti-Virus Emergency Response Team) announced today that is has given a High Risk Assessment to the newly discovered worm called VBS/NewLove. The worm, which can distribute itself to every address in the users Global Address book, in Outlook, also has the ability to destroy files by overwriting them.
The worm operates in the same way the VBS/Loveletter did when mailing itself to the unsuspected user. A main difference found in NewLove is that the subject line of the mail is FW: followed by either the name from a recently used file or a random name and contains an attachment of the same file name. When the worm is first run, it drops a copy of itself in the Windows folder as either a name from the Recent Documents folder or a random name and has a random extension chosen from a list including .Doc, .Xls, .Mdb, .Bmp, .Mp3, .Txt, .Jpg, and .Gif it also includes the real extension, ".vbs". The worm will modify that copy by adding random comments to its body.
NewLove will search all local and mapped drives and attempts to replace itself into each file. Due to a bug in the code it fails and the files it creates instead of the originals are 0-bytes long. It then deletes the original. Despite the High Risk Assessment VBS/NewLove is not seen to be spreading at the same rate as VBS/LoveLetter. Customers do not need to take drastic action but should follow normal precautionary measures and update their products.
A cure can be downloaded from the Network Associates web-site at www.nai.com.
Share
