Skip to main content /TECH with /TECH


Worm tries to attract surveillance attention


By Matthew Woollacott

(IDG) -- U.K.-based security software vendor Sophos has warned of a new variant on the "Love Bug" worm which, as well as infecting users' machines, seems designed to attract the attention of the "Echelon" surveillance system. Sophos added that it has found just one example of the worm in the wild.

Dubbed "VBS/LoveLet-CL," the worm creates two copies of itself on the user's hard drive using the file names command.vbs and WinVXD.vbs, and these files are executed every time the computer boots up, according to Sophos. The worm is Visual Basic Script (VBS)-based, and tries to send itself to every address in an infected Outlook user's address book in e-mails with the subject line "!!!", the company said.

Visit an IDG site search

Within the worm's code are written numerous comments and code words that Sophos said may be designed to trigger monitoring by the international Echelon system -- possibly in an effort to overwhelm it if the virus becomes widespread. These include "sabotage," "assassination," "booby traps," and "terrorism."

Among the virus' other effects, it searches for files with a range of extensions and overwrites them with itself. It can also propagate itself using mIRC (Internet Relay Chat).


• Echelon: Exposing the global surveillance system
• Sophos Anti-Virus

Note: Pages will open in a new browser window
External sites are not endorsed by CNN Interactive.


Back to the top