Hi � � >Experts warn of Love Bug variant > >Infected 'love letters' are dropping back into inboxes once again as >the recent spate of socially engineered viruses continues. This time, >a modified version of the infamous Love Bug is doing the rounds, >masquerading as an animated picture of someone's new baby. >Antivirus >experts have pointed out that the newly discovered 'Myba' virus is >really just a modified version of the Visual Basic script that made up >the Love Bug code and is identical in many ways. >The virus arrives as >an executable attachment on an email with the subject line: 'My >Babypic'. The message body text reads: 'It's my animated baby >picture!!!', and the attachment is MYBABYPIC.EXE. >If the file is >executed, a picture of a baby pops up and when this is closed the >virus copies itself to the Windows/System directory several times, and >adds a number of registry entries allowing it to execute at Windows >boot up. The virus also redistributes itself to all the email >addresses found in the Outlook address book, unbeknown to the user. > >The virus has already been spotted in the wild and its actual payload >has been labelled as "very dangerous" by Eugene Kaspersky, head of >Kaspersky antivirus labs. It has been given a medium level warning by >another antivirus firm, Trend Micro. >"Myba carries a very dangerous >payload that can easily destroy important data on your computer," said >Kaspersky. "Depending on the current time and date it can switch on or >off NumLock, CapsLock and ScrollLock keys." >He explained that the >virus also sends the message '.IM_BESIDES_YOU_' to the keyboard >buffer, then connects to the website www.youvebeenhack.com and sends >one of the following text messages: 'FROM BUGGER', 'HAPPY VALENTINES >DAY FROM BUGGER' or 'HAPPY HALLOWEEN FROM BUGGER'. >The virus also >fills all available disk space and corrupts files with the following >extensions: VBS, VBE, JS, JSE, CSS, WSH, SCT, HTA, PBL,CPP, PAS, C, H, >JPG, JPEG, MP2 and MP3. >Updates to beat the virus are already >available from most antivirus vendors' websites.