There is a newly evovled virus known as "Elecciones2000". It is a variant of the Melissa virus that can delete the contents of your hard disk. It is a macro virus affecting Microsoft Word 97/2000 documents, and contains a destructive payload. The virus first infects the host before replicating by emailing itself through MS Outlook to the first 50 names in the user's address book. The macro virus can disable macro-warning notification in applications, allowing it to slip on to your system unnoticed. Once there, it checks the following value in the registry:

"HKEY_CURRENT_USER\Software\Microsoft\Office"
"Elecciones2000" = "Pacocha :-P"

If the value is not equal, it begins the replication process and e-mails itself out. From January through April, on the 1st through 9th day of the month, email messages from infected users will contain an infected attachment with the subject line

"Elecciones 2000: ultima encuesta Apoyo!"
All other times, it is "Urgente: Confirmar!"

The Elecciones2000 virus, which is presumed to have originated in Peru, contains a 'logic bomb" that is set to detonate on the 9th day in the months April through December. April 9th was the day of the 2000 election in Peru when incumbent Alberto Fujimori defended his presidency from former World Bank economist Alejandro Toledo.

Once activated, the payload deletes all files on all drives, starting with drive C and finishing with drive Z. This could lead to a massive loss of data if a network user had write access to many networks shares that were mapped to drive letters.

Signs of infection include mass file deletion on the 1st and/or 9th day of the month, modification of the registry and e-mail anomalies.

CHIP Magazine - India

Computer Associates have sent an emergency warning to Middle East users about a new Spammer.A worm, which risks complete destruction of Enterprise and Consumers PCs. The Spammer.A worm is known as VBS.NewLove.A, leading many to compare it to the original love bug, though Computer Associates have advised that they are not related.

Rabie Fares, marketing director of Middle East operations, Computer Associates, told "Love Bug II has an extremely destructive payload that renames the files and sets their file size to zero. The CA antivirus research laboratory has a solution which eradicates polymorphic worms and we have sent the source code to the FBI."

CA acts fast to distribute the signature files to government authorities. The extreme damage these viruses can cause make it imperative the authors of worms are tracked down. A virus is not a game. With Love Bug II we are dealing with hate mail that can literally destroy a computer in 20 seconds,"Fares cautioned.

Windows Magazine - Middle East