Worm tries to entice with 'lov ya' message

Five years after the world fell victim to the "I love you" virus, a malicous-software writer is trying a similar trick on unsuspecting users.

Antivirus company Sophos unearthed the new mass-mailing worm, dubbed Assiral, on Monday. It mimics the earlier virus, which used the phrase "I love you" in subject lines to entice recipients into opening the destructive e-mail and attachment (which was typically titled "love-letter-for-you"). The original bug wrought havoc on networks around the world, but Sophos doesn't think Assiral will be as destructive.

"The Assiral worm uses an old trick to seduce users into believing they may have received a romantic love letter," said Graham Cluley, senior technology consultant for Sophos. "It's almost five years since the infamous Love Bug worm fooled millions of Windows users around the world using a similar tactic--and it seems unlikely that Assiral will have anything like as much impact."

Assiral e-mails are sent with the subject line "LOV YA!" and contain text asking the reader to open an attached file. A typical example can be seen below:

Subject:
Re: LOV YA!

Body:
Kindly read and reply to my LOVE LETTER in the attachments :-)

Attachment title:
LOVE_LETTER.TXT.exe

Attachment body:
Greetz from LARISSA.B!
I will survive,
In this moment in time.
You computer will crash,
So, you will be mine.
I never crash,
I never fail.
So, in this moment in time,
I will surive...
-LARISSA AUTHOR - 5-15-05

If the attached file is launched, the worm opens a Web page hosted at Geocities and attempts to send itself to contacts in the recipient's Outlook address book.

To read Sophos' advisory on Assiral, click here.

Dan Ilett of ZDNet UK reported from London.