Avril Lavigne Virus Hits the Web

Date 9-Jan-2003 8:23:09
Topic: Internet News

A new worm?going by various names, including Avril, Lirva and Naith?is infecting machines in the United States and abroad. In addition to forcing users to visit Lavigne's Web site, the worm continues a recent trend among viruses by attempting to disable various anti-virus and firewall products on infected machines.

The worm searches each PC's hard drive for HTML files that may contain e-mail addresses and then uses its own built-in SMTP (simple mail transfer protocol) engine to send copies of itself to whatever addresses it finds. However, initial analyses have found that there may be an error in the code that prevents some copies of the outgoing message from being sent.

The text of the e-mail containing the virus is a poor, mistake-filled imitation of a security bulletin from Microsoft Corp. It reads, in part:

"Patch is also provided to subscribed list of Microsoft Tech Support: to apply the patch immediately. Microsoft strongly urges all customers using IIS 4.0 and 5.0 who have not already done so and do not need to take additional action. Customers who have applied that patch are already protected against the vulnerability that is eliminated by a previously-released patch. Microsoft has identified a security vulnerability in Microsoft IIS 4.0 and 5.0. To prevent from the further buffer overflow attacks apply the MSO-patch."

MessageLabs Ltd., a British MSP that tracks virus activity, said it has stopped more than 5,000 copies of the virus since Monday. So far, the Lirva worm has shown up in more than 40 countries.

The subject line and attachment name are random.

It's becoming somewhat of a rite of passage for teen idols to have their names attached to a virus. Tennis player Anna Kournikova, singer Britney Spears and singer/actress Jennifer Lopez are three of the celebrities who have had viruses named after them.

This article comes from AmigaWorld - Amiga Community Portal

The URL for this story is: