Net-Sec mini letter 
Issue 13 - 20.05.2000 
http://net-security.org 

For any feedback or comments, mail staff@net-security.org 

"New Love" is a new Visual Basic Script worm with a very damaging payload. Once executed, it tries to spam itself to all users in the Microsoft Outlook address book. When the worm is first run it drops a copy of itself in the Windows folder as either a name from the Recent Documents folder or a random Name and has a random extension chosen from Doc, Xls, Mdb, Bmp, Mp3, Txt, Jpg, Gif, Mov, Url, Htm, Txt and the real extension, ".vbs" The worm will modify that copy by adding random comments to its body. AV companies say that it is not spread around on the Internet (at least not yet). 


Information from Anti-Virus companies. 


Trend Micro (www.antivirus.com) 

Name: VBS_NEWLOVE.A 
More information: http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VName=VBS_NEWLOVE.A 
Latest virus pattern: http://pattern.download.antivirus.com/ftp/products/pattern/lpt708.zip 


AVP (www.avp.ch) 

Name: I-Worm.NewLove 
More information: http://www.avp.ch/avpve/worms/newlove.stm 
Latest virus pattern: http://www.avp.ch/E/updates.htm 


Sophos (www.sophos.com) 

Name: VBS/NewLove-A 
More information: http://www.sophos.com/virusinfo/analyses/vbsnewlovea.html 
Latest virus pattern: http://www.sophos.com/downloads/ide/newlovea.ide 


NAI (www.avertlabs.com) 

Name: VBS/Newlove.a 
More information: http://vil.nai.com/villib/dispvirus.asp?virus_k=98655 
Latest virus pattern: http://download.nai.com/products/Mcafee-Avert/newlv4.zip 


F-Secure (www.f-secure.com) 

Name: VBS/Newlove.a 
More information: http://www.f-secure.com/v-descs/newlove.htm 
Latest virus pattern: http://www.f-secure.com/download-purchase/updates.html 


FInjan Software (www.finjan.com) 

Advisory: http://www.finjan.com/attack_release_detail.cfm?attack_release_id=37 


Media outlets produced literally tons of articles about "New Love" worm: 

NewLove proves less costly 
http://www.cnnfn.com/2000/05/19/technology/virus/ 

New Love Virus Slow To Spread 
http://www.crn.com/dailies/digest/breakingnews.asp?ArticleID=16786 

New virus hits computers 
http://news.ft.com/ft/gx.cgi/ftc?pagename=View&c=Article&cid=FT3ACD94G8C&live=true&tagid=ZZZC00L1B0C&subheading=information%20technology 

Deadlier virus does limited damage in aftermath of 'Love bug' 
http://news.cnet.com/news/0-1005-200-1902621.html?tag=st.ne.1430735..ni 

A New Virus Appears, Some Question the Fear 
http://dailynews.yahoo.com/h/nm/20000519/tc/tech_virus_2.html 

'New Love' Virus Spawns Net Security Questions 
http://www.thestandard.com/article/display/0,1151,15306,00.html 

The Virus 'Ambulance Chasers' 
http://www.wired.com/news/technology/0,1282,36464,00.html 

"New Love" Threat 
http://www.nandotimes.com/technology/story/0,1643,500206111-500287071-501549577-0,00.html 

Network Associates downgrades "NewLove" threat 
http://news.cnet.com/news/0-1005-200-1903744.html?tag=st.ne.1430735..ni 

New Virus Shows Little Impact 
http://www.pcworld.com/pcwtoday/article/0,1510,16819,00.html 

Hacker Rails Against New Worm 
http://www.wired.com/news/technology/0,1282,36477,00.html 

New virus won't infect Macs 
http://www.idg.net/ic_179263_1794_9-10000.html 

Computer Associates Warns of New `Love Bug' Virus (Update2) 
http://quote.bloomberg.com/fgcgi.cgi?ptitle=Technology%20News&s1=blk&tp=ad_topright_tech&T=markets_fgcgi_content99.ht&s2=blk&bt=ad_bottom_tech&s=AOSTy7hSiQ29tcHV0 

Virus 'worse than Love Bug' on the loose 
http://www.vnunet.com/News/1101596 

First British companies report NewLove virus 
http://www.zdnet.co.uk/news/2000/19/ns-15473.html 

Chameleon-like Virus Hits Internet 
http://www.apbnews.com/newscenter/internetcrime/2000/05/19/lovebug0519a_01.html 

New virus more vicious than Love Bug 
http://www.out-law.com/php/page.php3?page_id=newvirusmorevicio958745671 

New Love: A Whole Lot of Nothing? 
http://www.wired.com/news/technology/0,1282,36455,00.html 


HNS staff 
staff@net-security.org