New 'Lovebug' Computer Virus Variants Add to Havoc

July 7, 2008 - 8:02 PM

London ( - Filipino police Friday were said to be closer to tracking down the creator of the "lovebug" computer virus, which continues to wreak havoc around the world even as three new variants appeared and began to add to the massive damage already caused.

The Philippines authorities suspect the perpetrator may be a 23-year old man living in a middle-class Manila suburb. They're trying to track him down with the help of an Internet service provider, which believes the virus may have spread from two of its email addresses.

The "ILOVEYOU" virus, which deletes certain files and also forwards itself to every email address in the address book of the Windows Outlook email program, has affected businesses and governments around the world, from multinational corporations to the Pentagon and British parliament.

One UK virus protection provider intercepted 6,000 copies of the bug on Thursday, compared to only 1,600 copies of last year's notorious Melissa virus caught over a 12-month period. An estimated 10 percent of British businesses have been affected.

Lloyds of London insurers estimate damages caused to businesses in the UK could run into tens of millions of pounds.

Lloyds spokesperson Sarah Pelling told the impact was being assessed but it was too early to quantify the cost.

"It's quite difficult ... someone will need to pull all the figures together. It won't just be one company involved in the insurance," she explained.

"This is probably the fastest-spreading virus I've ever seen," Graham Cluley of the anti-virus computer company Sophos told Friday. "This is bigger than Melissa, which at the time was enormous."

Anti-virus programmers were racing Friday to stay ahead as at least three new offshoots of the "love bug" emerged. One U.S. company said there may be as many as 10 copycat viruses able to elude software designed to block messages containing the original virus.

One is called "Joke" and comes with an email attachment called "very funny.vbs" while the second, in Lithuanian, was called "Susitikim shi vakara kavos puodukui" ("Let's meet this evening for coffee.")

A third reported variant has the words "Mothers Day Order Confirmation" in the subject line, and carries a message indicating that an invoice is attached for a $326.92 order for the "mothers day diamond special." When users open the attached "invoice," the virus activates and deletes all files on the computer with .ini and .bat suffixes.

Cluley said it was possible the new variants were written by someone other then the original virus creator.

"It is quite possible the new variant was not written by the original programmer because the original source code was contained in the virus and that was sent to millions of people. Any of those people could have taken it and used it as the basis for launching the new virus."

He said the most costly effect of the virus was "that it clogs up email systems and companies shut down their email. So many companies are doing electronic commerce, communicating with their customer base via email, if you shut down your emails, you stop doing business."

The virus also overwrites and destroys some picture (JPEG) and music (MP2 and MP3) files "which is nasty, but hopefully most people have backups."

People receiving emails should check carefully for the .vbs (visual basic scripts) tag on attached files. Infected emails should immediately be deleted.

"The important thing is, don't open the file, don't double-click on the attachment."

Cluley also urged computer-users to update their anti-virus software.

"Even if you updated yourself yesterday to protect against the first version of love letter, I'm sorry, but you've got to update it again today to deal with these two new versions."

Alan Stevens, head of digital services at the UK Consumers' Association, said: "This has been done as a joke, but the worrying aspect is that cyber terrorism aimed at a company or a country has become relatively easy to do. We haven't seen the last of it."

"The fundamental problem is that everyone's problems are interconnected," Cluley told "We really are a global village now and if you want to spread leprosy around the village it doesn't take very long at all."

The other problem, he added, is that so many people are using the same operating system (Microsoft Windows) and the same email software (Microsoft Outlook).

"If you're a virus-writer, and you want to cause trouble, it's very, very easy to do."

Cluley said even if the instigator of the virus was caught, the virus would still be "out there."

"Even if he's sent to jail, his virus is still going to cause problems."