F-Secure has warned PC-based Outlook users of a new Love Bug variant, called ‘NewLove.A’. The bug, which once again affects only Windows PCs, is a mutated form of the original Love Bug virus. It deletes all the files on a users hard drive, and any attached network drives. The new polymorphic or ‘mutating’ worm reproduces by mailing out from a user’s Outlook Express address book, but NewLove.A mutates to make itself more virulent and less detectible.
The virus chooses a filename randomly from the Windows/Recent folder and attempts to forward a version of itself to everyone in the address book, with .vbs as the extension name. The virus then goes through all the files on a drive, adding the .vbs extension name and deleting the originals.
F-Secure warns PC-based users to beware of the .vbs extension. Finally, the worm works only in Microsoft Outlook email software, using the Visual Basic script within the software to run. Instructions for disabling the Visual Basic script are available from www.f-secure.com.