From: http://www.msnbc.com/news/403350.asp?0a=2103430- FBI says it has �Love� virus suspect Computer bug troubles persist as tricky mutations make the rounds Toby Ayre, technical consultant for Internet service provider SKYInternet, explains how the Love Bug virus works at a news conference in Mandaluyong, Philippines Friday. By Bob Sullivan MSNBC May 5 � U.S. investigators have told NBC News� Pete Williams they have identified a suspect they believe is responsible for the ILOVEYOU virus. �We�re convinced,� the virus attack originated in the Philippines, said one official, who added the suspect won�t be identified until a search warrant is executed. Meanwhile, there are now five known variants of the bug, including one that tries to trick victims into opening an attachment by claiming it�s a bill for diamonds purchased at a special Mother�s Day price. U.S. FEDERAL AGENTS, working in cooperation with local authorities, were led to the suspect by electronic evidence, NBC�s Williams was told. The official, who requested anonymity, added the FBI is now seeking a search warrant and is waiting only for authority from Philippines judges before they serve the warrant. Meanwhile, anti-virus experts say computer admistrators around the world are contining to fight the Love Bug, which now comes in five flavors, including the more dangerous �Mother�s Day� mutation. �We�ve seen the situation just get worse in Asia and Europe during Friday,� said Mikko Hypponen, manager of anti-virus research at F-Secure Corp. �With four new variants out after the original one, it�s getting more and more difficult for end users to know which e-mail to avoid.� The latest variant might cause the most trouble. It attempts to prey on consumer fears of erroneous credit card charges and arrives with the subject line �Mother�s Day Order Confirmation.� The body of the message then tells the potential victim: �We have proceeded to charge your credit card for the amount of $326.92 for the mothers day diamond special. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place. Thanks Again and Have a Happy Mothers Day! [EMAIL PROTECTED]� The attached file, mothersday.vbs, is very similar to the original ILOVEYOU virus but is considerably more destructive. It sets out to delete all .INI and .BAT files from all local and network drives. Removing such files could make it impossible to restart a victim�s computer. �With only eight days to go until Mother�s Day, this attack is quite credible,� Hypponen said. Carey Nachenberg, chief virus researcher at Symantec, tells CNBC that 'Love Bug' copycat viruses are beginning to spread, and that computer networks are extremely vulnerable to future worms. A Manila Internet services provider, Supernet, said it was assisting in the investigation, adding that the virus appeared to have first spread from two of its e-mail addresses. �The author of the virus used two e-mail addresses through Supernet � [EMAIL PROTECTED] and [EMAIL PROTECTED],� Jose Carlotta, chief operating officer of parent company Access Net Inc, a Manila Internet company, told Reuters. Inside all versions of the �love� virus are the two Supernet e-mail addresses. Combined with information gleaned from Internet chat rooms, Carlotta said, the e-mails provided investigators with a solid lead, but no definitite information. The e-mails have been linked to prepaid Internet access accounts so it was not immediately possible to zero in on the owner, he added. Toby Ayre, a technical consultant for SkyInternet, another Philippine ISP, told reporters it appeared the same hacker had tried to break into their systems. In response, the company blacklisted the local Manila telephone number the intruder was using. �We banned this particular person from our servers on April 1,� Ayre said. He added that the hacker had used the same �signature� at SkyInternet as had been seen at Supernet. �We have provided the NBI, the FBI, and Interpol with all of the audit trails for every transaction that involves this virus and they�re using that information,� he added. STILL CIRCUMNAVIGATING THE GLOBE While authorities tried to track down the culprit, the ILOVEYOU virus continued to infect computers around the globe on Friday, though not at the rate of Thursday�s rampage. The federally-funded CERT Coordination Center, a clearinghouse for U.S. computer crisis information, said it was still receiving reports of outbreaks. New variations of the �worm� were were also winging around the Internet, in some cases foiling anti-virus protection. A version of the virus named �Luck� started appearing Thursday afternoon, and other copycats have followed. One variant, called Susitikim (which in Lithuanian means: Let�s meet), has a subject line that reads �Susitikem shi vakara kavos puodukui.� In Lithuanian, the sentence translates into: �Let�s meet this evening for coffee.� The virus shut down networks at corporations and government agencies all around the world. The U.S. Navy, Army, and NASA research centers all shut off e-mail access to protect their systems from the storm. Several government agencies were still infected; according to NBC�s Betsy Steuart, the U.S. State Department found about 120,000 versions of the I Love You virus and its various mutations on their servers. HOW IT WORKS ILOVEYOU arrives as an e-mail attachment in a message apparently sent by a colleague. The virus targets users of Microsoft Outlook and only works under the Windows operating system. (Microsoft is a partner in MSNBC.) If a victim is tricked into opening the attached program, which is written in Microsoft�s Visual Basic script, the virus renames every jpg image file and mp3 music file it can find. The images are deleted, but the mp3 files are backed up elsewhere on the victim�s computer. The program also deletes a host of other files with the following extensions: .VBS, .VBE, .JS, .JSE, .CSS, .WSH, .SCT and *.HTA But before deleting image and music files, the virus e-mails itself to every person or destination in the victim�s various address books, including any corporate distribution lists. That�s why it spreads so fast. But the virus also has another trick up its sleeve. After infection, it changes the victim�s Internet start page to one of four Web pages hosted at skyinet.net by SkyInternet. There, the victim�s computer is instructed to download a password-stealing program called WIN-BUGSFIX.EXE. Ronald Elciario, a network administrator at SkyInternet, told MSNBC those Web pages have since been removed and the account holder�s services have been terminated. In the virus�s source code, an individual named �spyder� takes credit for authoring the program. Mikko Hypponen, manager of antivirus research at F-Secure Corp., said the name is unknown on the virus scene. In a bit of programming understatement, the code contains a comment, likely by the author, suggesting the virus is �simple but i think this is good.� The code also references Manila, but that doesn�t necessarily indicate the author lives there. Other than the e-mail addresses, there are no other hints as to who �spyder� might be other than this cryptic message within the code: �barok -loveletter(vbe) �i hate go to school�.� It�s the love letter seen �round the world, reports NBC�s Pete Williams. Computer technicians around the globe held their breath Friday, hoping they had largely beat back the virus. Perhaps tens of millions of computers have been infected, experts said, and it is already being called the worst virus outbreak ever. But there is evidence that ILOVEYOU may yet do more damage before the worst is over. Companies in New Zealand and Australia reported infection as daylight came to that part of the world Friday, and others resorted to shutting off all e-mail to protect themselves from infection. �I don�t think it�s over,� said Joe Wells, a long-time antivirus industry observer. �Melissa came and went because it had limitations. This thing doesn�t turn itself off.� That might be bad news for the thousands of businesses that forced to shut down entire networks on Thursday in order to quarantine computers from infection. If even one copy of the virus remains on a network, restarting mail services could restart Thursday�s ordeal all over again. So many employees left work Thursday night with no guarantee things would be back to normal by Friday. Where to get help Several antivirus companies and computer pros are offering information and tools to help remove the ILOVEYOU virus from PCs. Many sites are working slowly because of high traffic. � ZDNet ILOVEYOU Anti-Virus Center � McAfee.com Anti-Virus � F-Secure's info on how ILOVEYOU works � Trend Micro's HouseCall online virus scanner � Info from thePope.org on removing ILOVEYOU The statistics Thursday were staggering. Nearly 30 percent of businesses in Great Britain, and nearly 80 percent in Sweden, have been infected by the virus, according to Network Associates. In fact, the company said, ATM cash machines in Belgium were knocked offline thanks to the deluge of e-mail traffic created by the virus. The CERT Coordination Center has received reports that over 300,000 computers had been infected � and that only represents those systems where administrators registered the infections with CERT. Many companies � and even the Army and the Navy, NASA � resorted to simply shutting down their e-mail systems while the virus wormed its way around the Internet. �This is the worst I�ve ever seen in my nine years in the business,� said Hypponen. Internet users were advised to update their virus scanning software as soon as possible. But throughout the day Thursday, antivirus Web pages were swamped with traffic and largely unreadable. But the standard advice held true � the best bet is to avoid opening attachments entirely. Researchers said the technology that spreads the virus is no smarter than that of previous viruses, leaving them a bit baffled over LoveLetter�s global impact. One possible reason � victims cannot resist opening an attachment that claims to be a love letter. �Only human nature to want to open a letter that leads off with �I love you,� � said David Perry, public education director at antivirus research firm Trend Micro. He said he also suspects that because it had been several months since the last virus scare, computer users are a bit more gullible than they were perhaps a year ago, in the wake of the Melissa virus. The file attachment is called �LOVE LETTER FOR YOU.TXT.vbs,� which might also be adding to the confusion for consumers. It offers the appearance of being a harmless text file, and the �vbs� extension, which stands for Visual Basic Script, may also mislead users who are now trained to be skeptical of executable files with the extension .exe. Computers aren�t the only victims. One doctor who e-mailed MSNBC said the virus had been arriving every five minutes to his pager, which receives incoming e-mails. Several readers also report having received the virus by fax, since both pagers and fax numbers can be listed in an Outlook address book. #### ================================================================= Kadosh, Kadosh, Kadosh, YHVH, TZEVAOT FROM THE DESK OF: <[EMAIL PROTECTED]> *Mike Spitzer* <[EMAIL PROTECTED]> ~~~~~~~~ <[EMAIL PROTECTED]> The Best Way To Destroy Enemies Is To Change Them To Friends Shalom, A Salaam Aleikum, and to all, A Good Day. ================================================================= <A HREF="http://www.ctrl.org/">www.ctrl.org</A> DECLARATION & DISCLAIMER ========== CTRL is a discussion & informational exchange list. Proselytizing propagandic screeds are unwelcomed. Substance�not soap-boxing�please! These are sordid matters and 'conspiracy theory'�with its many half-truths, misdirections and outright frauds�is used politically by different groups with major and minor effects spread throughout the spectrum of time and thought. That being said, CTRL gives no endorsement to the validity of posts, and always suggests to readers; be wary of what you read. CTRL gives no credence to Holocaust denial and nazi's need not apply. Let us please be civil and as always, Caveat Lector. ======================================================================== Archives Available at: http://home.ease.lsoft.com/archives/CTRL.html <A HREF="http://home.ease.lsoft.com/archives/ctrl.html">Archives of [EMAIL PROTECTED]</A> http:[EMAIL PROTECTED]/ <A HREF="http:[EMAIL PROTECTED]/">ctrl</A> ======================================================================== To subscribe to Conspiracy Theory Research List[CTRL] send email: SUBSCRIBE CTRL [to:] [EMAIL PROTECTED] To UNsubscribe to Conspiracy Theory Research List[CTRL] send email: SIGNOFF CTRL [to:] [EMAIL PROTECTED] Om
