http://news.cnet.com/news/0-1003-200-1815107.html?tag=st.ne.1002.thed.1003-200-1815107
By Paul Festa
Staff Writer, CNET News.com
May 4, 2000, 2:55 p.m. PT
Network administrators warn that the "I Love You" virus is circulating
under the new name "Very Funny," potentially evading the filtering
efforts of those battling the worm.
One network administrator said he first spotted the renamed virus in
an email with the subject header "Fwd: Joke" around noon today.
Antivirus software aimed at neutralizing I Love You may not work
against Very Funny, administrators said. Utilities written to filter
out I Love You based on name alone will not work.
Some security software providers are issuing new patches designed to
include protection against the Very Funny variant.
"It seems to be that someone has changed the name of the attachment
and the subject line," said Nerender Mangalan, director of security
strategy for Computer Associates. "Basically it's the exact same file,
and it does the exact same thing, but it's renamed so people looking
out for I Love You would open it."
Computer Associates said it would post its updated patch by around 3
p.m. PT.
Representatives from Microsoft said they had no information about the
new variation of the virus.
Some network administrators said other software patches were effective
against Very Funny.
"We deleted all the emails with I Love You in the header," said
Carmelo Lisciotto, director of network operations for online auction
site uBid. "We got the first email this morning, and we ran some
command-line utilities to delete anything with that header."
Those filters failed to detect Very Funny.
But Lisciotto said antivirus software designed by Microsoft and
Symantec for I Love You did work against Very Funny.
The origin of Very Funny, like that of I Love You, remains obscure.
But Lisciotto and others were skeptical that the virus was written to
rename itself.
"Personally, I think someone re-sent it," Lisciotto said.
*-------------------------------------------------*
"Communications without intelligence is noise;
Intelligence without communications is irrelevant."
Gen. Alfred. M. Gray, USMC
---------------------------------------------------
C4I Secure Solutions http://www.c4i.org
*-------------------------------------------------*
ISN is sponsored by SecurityFocus.com
---
To unsubscribe email LISTSERV@SecurityFocus.com with a message body of
"SIGNOFF ISN".
Received on Thu May 4 23:27 CDT 2000