Love bug computer virus adopts new disguises

The ''love bug'' that crippled computer systems around the world showed up again Friday cloaked in new disguises, pretending to be such things as an e-mail joke or a receipt for a Mother's Day gift.

Anti-virus software makers rushed out updates to fight the variations, and the FBI expanded its criminal investigation of an outbreak some experts say could cause up to $10 billion in damage.

As many as seven new variations struck on Friday, a day after the original raced across at least 20 countries, overwhelming computer networks and destroying important computer files. The original bug arrives as an e-mail labeled ''ILOVEYOU'' and carries an attachment called ''LOVELETTER.''

One new version arrives as confirmation that the recipient's credit card has been charged $326.92 for a Mother's Day ''diamond special,'' urging the reader to click on an attachment to print the invoice.

Opening the attachments releases the bug.

''This will be the most damaging virus as well as the most widespread virus or Internet worm that we've ever seen,'' said Gene Hodges, president of the McAfee security division of Network Associates, a computer security business.

Some organizations suffered heavy damage, as the virus destroyed files storing crucial information, pictures and video.

Jeff Carpenter at the CERT Coordination Center, a government-chartered computer emergency team at Carnegie Mellon University in Pittsburgh, said the bug infected about 600,000 computers worldwide. As an example of the disruption, CERT projected the virus cost a company with 12 computers a total of about $30,000 in lost work time and recovery.

The FBI and authorities in the Philippines were investigating leads suggesting the virus originated in Manila, including clues embedded in the virus' program code and information from an Internet service provider.

''It could be a lead or a red herring,'' said one FBI official, who spoke on condition of anonymity. ''We're not at a point where we are able to definitively say what the origin was.''

The FBI expanded its probe to include the new variations. Agency spokesman Steve Berry would not speculate whether the new bugs were the product of copycats or the original author.

The first variation began whipping across e-mail systems by Thursday night, masquerading as a joke passed on by an acquaintance with an attachment labeled ''Very Funny.''

Although it was spreading with the same lightning speed as the original, computer security firms reported far less damage among their customers - possibly due to software inoculations deployed on Thursday and a more wary attitude among computer users who were caught off guard by the first attack.

''It's definitely calming down, at least with 'LOVELETTER,''' said Sal Viveros, a director at McAfee.

The joke version ''is spreading very very quickly, but nowhere as quickly as 'LOVELETTER' because people are really aware of not clicking on attachments, and many people got a cure for 'LOVELETTER' that blocks new variants,'' Viveros said.

McAfee and other anti-virus firms said they were receiving only isolated reports of the Mother's Day version and another with a subject line reading, ''Susitikim shi vakara kavos puodukui,'' which translates from Lithuanian as ''Let's meet tonight for a cup of coffee.''

In all cases, however, experts cautioned computer users not to open any suspicious e-mail attachments.

Friday's victims included United Nations headquarters in New York, where the e-mail system was temporarily shut down as a precaution even as the organization was grappling with a hostage crisis in Africa.

There were several attempts to quantify the extent of the outbreak, which most experts agreed was the worst yet in scope and damage.

Computer Economics Inc., a research company based in Carlsbad, Calif., said 45 million people worldwide received the infected e-mail Thursday. The company estimated damage at $2.6 billion for the first day alone and as high as $10 billion before it's contained. Viruses caused an estimated $12.1 billion in damage during all of 1999.

Seattle-based Safeco Corp., which has more than 11,000 employees nationwide, was among the businesses that turned to handwriting, telephones and other means of communication as the virus forced them to shut down e-mail and instant messaging systems.

''This thing has caused a major hassle,'' said Le Roi Brashears, a spokesman for the insurance and investment company. ''We had to resort to digging out the floppy disks and using pencil and paper.''

---

EDITOR'S NOTE - Associated Press Writer Michael J. Sniffen contributed to this report from Washington.

---

On the Net:

National Infrastructure Protection Center: http://www.nipc.gov/

CERT Coordination Center: http://www.cert.org

Anti-virus companies: http://www.symantec.com

http://www.nai.com

http://www.drsolomon.com