More Attacks Target E-mail Systems - Industry Trend or Event

ENT, June 14, 2000

Two new viruses cropped up in the wake of the ILOVEYOU virus, again threatening e-mail systems worldwide. The viruses, however, did not spread as far as ILOVEYOU, having a smaller impact on the general computer community.

The "Killer Resume" worm is disguised as a job seeker's resume. It hit a number of systems May 19. The worm deletes critical files on a user's system after being activated by opening an attachment. The worm arrives via e-mail with the subject line "Resume--Janet Simons" and includes an attachment labeled resume.doc or explorer.doc.

Also on May 19, Computer Associates International Inc. (CA, www.ca.com) warned of a new worm known as Spammer. A that is more destructive than ILOVEYOU, and which also proliferates via e-mail. CA says that the new worm is unrelated to ILOVEYOU

A polymorphic worm, Spammer.A, also known as VBS.NewLove.A and VBS.Spammer.A, renames files on an infected user's computer and sets file sizes to zero. Because of its morphing capabilities, Spammer.A is considered more dangerous than recent worms.

Spammer.A arrives attached to an e-mail message with the subject line implying a forward with "FW:" followed by a file name with the extension DOC, XLS, MDB, BMP, MP3, TXT, JPG, GIF, MOV, URL, or HTM followed by .VBS.

The worm installs itself by copying its code to Windows and System directories and modifying two registry keys. As a polymorphic worm, Spammer.A modifies its code when changing from generation to generation.

Both CA and Symantec Corp. (www.symantec.com) have filters for Killer Resume. CA has a solution for polymorphic worms such as Spammer.A.