Experts say "Love" spawns at least 8 mutations

Security experts are scrambling to keep up with mutations of the "I Love You" virus that may evade earlier fixes, including a new variant that plays on the upcoming Mothers' Day holiday.

As earlier reported by CNET News.com, a version called "Very Funny" was among the first identified. But antivirus researchers say that at least eight different versions are rippling through the Net and warn that more are likely on the way.

"There's a big hacker community out there, and anyone could open up the script," said Steve Gottwals, senior product manager for security company F-Secure. "It's really easy to make a variant."

The most prevalent new form of the virus today is a variant called "Mothers' Day," antivirus companies say.

This version contains the words "Mothers Day Confirmation Order" in the subject line. The email informs readers that a $326.92 credit card charge was made for a Mothers' Day diamond special and directs them to print the attachment, allegedly an order invoice.

Computer users who click on the "invoice" will find their computers infected with a modified version of I Love You. But instead of attacking image and music files, as did the original, Mothers' Day overwrites ".bat" and ".ini" files needed to start the computer. That makes it potentially even more destructive than the original, researchers warned.

Most major virus companies

Variations on a virus The "Love" bug and eight of its variants spotted so far.
Version	Subject	Attachment name	Seen "in the wild"
a	I Love You	LOVE-LETTER- FOR-YOU.TXT. vbs	yes
b	Susitikim shi vakara kavos puodukui...*	LOVE-LETTER- FOR-YOU.TXT. vbs	yes
c	FWD: JOKE	VERYFUNNY. vbs	yes
d**	I Love You	LOVE-LETTER- FOR-YOU.TXT. vbs	yes
e	Mother's Day Order Confirmation	mothersday. vbs	no
f***	Dangerous Virus Warning	virus_warning. jpg.vbs	yes
g****	VIRUS ALERT!!!	protect.vbs	yes
h*****	A killer for VBS/LoveMail and VBS/Kak worm	viruskiller.vbs	yes
* Lithuanian for "Let's meet tonight for a cup of coffee." ** underlying code changed. *** message body reads: "There is a dangerous virus circulating. Please click attached picture to view it and learn to avoid it." **** message body begins: "Dear Symantec customer," and includes detailed explanation of the Love Letter virus. Variant targets some system files. ***** message body begins: "Start the attachment to clean all you (sic) files and hard discs (sic)." Source: McAfee and Symantec

have posted files on their Web sites that fix this version and the others that have been identified so far. Some companies are advising that people simply turn off the Windows feature that allows the viruses to work and are giving instructions on how to do so.

Several versions besides the Very Funny modification have popped up.

One version includes the words "Susitikim shi vakara kavos puodukui..." in the email's subject line, which F-Secure said translates to "Let's meet this evening for a cup of coffee..." in Lithuanian.

Others make tiny changes to the code of the virus that don't change its function but do allow it to slip past some of the antivirus filters.

"At least in some instances it seems tabs in the virus code have been changed to spaces," reported Security Focus' Elias Levy to the Bugtraq security mailing list. "That means the code looks the same, but it's not. Some antivirus products may be fooled by this."

The leading antivirus research houses have been working overtime to keep up with the different variants and post information and protection against the newcomers.

"I'm sure we'll see more variants," said Dan Schrader, antivirus researcher at Trend Micro. "The code is easily modified and easily spread."

The widespread Melissa virus outbreak followed a similar pattern, Schrader said. Melissa variants, some of them far more malicious than the original version, number in the 40s.

New patches began appearing yesterday, shortly after the Very Funny variant surfaced.

"It seems to be that someone has changed the name of the attachment and the subject line," said Nerender Mangalan, director of security strategy for Computer Associates. "Basically it's the exact same file, and it does the exact same thing, but it's renamed so people looking out for I Love You would open it."