'NEW LOVE' BUG VIRUS WORMS THROUGH THE NET.

Byline: Jason Z. Cohen Staff Writer

A new and more powerful variant of the Love Bug virus is worming its way through the Internet, changing its name with every computer it infects.

The new virus, which is being called the New Love virus, works similarly to the love bug that infected computers worldwide recently, but its spread has been kept in check by security precautions.

Internet security service provider ICSA.net estimated the virus has affected hundreds of North American organizations, well short of the tens of thousands of organizations impacted by the earlier virus.

The number may get as high as a thousand organizations, said Peter Tippett, chief scientist at ICSA.net.

Experts said the outbreak was limited by awareness and preparedness developed by computer users as a result of the previous virus.

In Washington, Attorney General Janet Reno launched an FBI investigation into the new virus, the Associated Press reported.

The new virus sends itself as an attachment to e-mails addressed to every person in the address book of the infected computer. Once it has been activated, it systematically deletes inactive files stored on the computer's hard drive.

``The big thing that is different about this one is the level of destruction,'' said Kevin Haley, group product manager for Symantec, maker of Norton Antivirus. ``It will completely delete all of the files on a user's system.''

Additionally, the virus is polymorphic, meaning it changes its look every time it is passed along, Haley said.

``It looks different for users, and it looks different for antivirus software,'' he said.

Chuck Jackson, a computer consultant who repairs computers and networks for Encino-based Fulton-Meyer Information Technology, said the virus kept him busy Friday.

Jackson said his clients were prepared.

One client, an Encino accounting firm, received 150 infected files, but the only effect was a slowing of the e-mail system, Jackson said.

He said e-mail filters helped weed out the offending attachments before they could be opened.

``Most of my clients are pretty well protected. Their business depends on e-mail, and when something like this hits it really affects them,'' Jackson said. ``When their system goes down, they're losing hundreds and thousands of dollars an hour.''

Even the public is better prepared, he said. But individual users must learn to protect themselves, Jackson said.

``A lot of times, they'll load an antivirus program on their computer, and they'll think they're safe,'' he said. ``In a time like this it should be updated almost daily.''

The virus takes advantage of a loophole in Microsoft's Outlook e-mail program that was designed to allow users of handheld devices to add e-mail addresses to the address books on their desktop computers.

On its Internet site, Microsoft has security patches available for Outlook 97, Outlook 98 and Outlook 2000. The patches contain various security enhancements.

Once it has established itself, the virus looks in the folder in which recently used documents are stored. Then, it picks the name of the most recently opened document and renames itself using that designation.

The virus carries a .vbs file extension, a file type for which most individual users have little use.

The file extension stands for Visual Basic Script, a language programmers and network administrators use to update software applications, Haley said.

Both Haley and Jackson said users should look out for e-mail attachments that end in .vbs and delete them without opening them, even if they come from someone they know.

Haley said Symantec, like other antivirus software makers, had an update available early Friday.

``We posted it on our Web site and made it available to all of our users,'' he said.

The newest virus has proved difficult to prepare for, he said. Rather than simply changing the virus profile that users routinely download, Haley said Symantec was forced to change the program software itself.

The upgrade takes 125 kilobytes of disk space and takes no more than a minute or two to download via a 56 Kb modem, he said.

Another potential effect of the virus is a slowing of traffic on the Internet, Jackson said.

``With all of those e-mails going out, it really affects the performance of the Net,'' he said.

Earthlink Networks users were not affected on the system level by an increase in the amount of e-mail traveling the Internet, said spokesman Kurt Rahn.

CAPTION(S):

photo, box

Photo:

(color) Attorney General Janet Reno joins Michael Vatis of the National Infrastructure Protection Center at a Washington news conference Friday. Reno said the FBI is investigating newlove.vbs - a new, more destructive variant of the Love Bug virus.

Leslie E. Kossoff/Associated Press

Box: A NEW BUG IN YOUR E-MAIL

Associated Press