Love Bug 2: experts say don't panic

Antivirus experts have calmed fears that a virus even more deadly than the Love Bug is about to swamp networks around the world.

The new variant of the Love Bug, called VBS/NewLove-A, is a polymorphic worm that mutates its appearance in an attempt to avoid detection by antivirus products.

However, the virus does not appear to be spreading as quickly as the Love Bug, and very few incidences of infections have been reported. This is good news for network managers because the virus' payload is believed to be more devastating than the original Love Bug which crippled many email systems.

Although it spreads in exactly the same way as the Love Bug - by emailing itself to everyone in a users' Microsoft Outlook address book - the name of the file it forwards is randomly selected from one of the filenames in a users' Start/Documents folder, making it extremely hard to spot.

The virus is written as a Visual Basic Script (VBS) attachment and has the extension .vbs.

If a user opens the file attachment, the virus overwrites numerous files and renders the computer inoperable. In addition, because of the way in which the virus mutates it rapidly increases in size on each infection. This means that affected mail servers may become increasingly slowed down by larger and larger amounts of email.

No one is currently sure where the latest variant originated, but the first reports of infection came from Israel. Jason Holloway, UK general manager at antivirus company F-Secure, said he had seen a couple of incidences in the UK and a few throughout the rest of Europe.

"The virus hit the US late yesterday and caught a few companies off guard, but you can usually tell within the first few hours how bad it's going to be and with the Love Bug we were inundated with calls," he said.

Jack Clark, European product manager at antivirus software vendor Network Associates, said the company has only seen two reports of European customers that have been hit by the virus.

"Many of our customers have now either started to disable Visual Basic scripting or have begun some sort of content scanning. Everyone's a little wiser now," he said.

"Having said that, the example we saw was called nicegirls.jpeg and that is exactly the kind of email that tends to get opened and sent around."

However, Clark said Network Associates would be downgrading the danger rating of the virus in the next couple of hours from high to medium.

Ian McManus, technical manager at Panda Software, said he had received no reports of the virus in the UK and only two from companies in Spain.

"I think one of reasons its isn't spreading so quickly is that it is so close to the release of the original. It would have had much more of an effect if the writer had waited a month or so for the smoke to clear before he released it."

So far, there are more than 30 variants of the Love Bug, which spread rapidly around the globe, causing millions of pounds worth of damage at the beginning of the month.