NicholasPyers.com

In the first week of May a new virus, “I Love You”, was released that received a large amount of attention in the regular media. What most of the media didn’t point out was how it only affects Windows users and that Macintosh users were largely unaffected. Here are a couple of emails I posted to AUSOM FirstClass and the Macs and Graphics mailing lists about this virus.

How to read this article

Basically the text that is “quoted” (ie appears in bold. The other text is a response I posted on May 7th, that clarifies or adds information to the first post.

The email

Date: Sun, 7 May 2000 11:20:37 +1000
From: Nicholas Pyers (nkp@zonian.net.au)
Subject: re: How “I love You” Virus affect Mac Users
To: general@fc.ausom.net.au, mag@pica.com.au

Earlier in the week, I wrote:

No doubt by now you are all aware of the “I Love You Virus” notices that are circulating left, right and center – In fact, I think are now more announcements about the virus (I got five separate ones from work colleagues, let alone all those from the net) then there real occurrences of the virus (and yes there have been thousands of reported incidents of the actual virus)

Well, it appears that the “I Love You Virus” has spread far and wide, causing lots of damage. While I haven’t seen the virus myself, I have heard from a lot of friends who have been affected at their places of employment and those places have been quite heavily hit.

There are also a few variants of it now – they have different attachment names and/or subjects but the effects are the same.

According to ZDNet, what actually happens is that “when a user running the e-mail program Microsoft Outlook clicks on the attachment, the virus sends a copy of itself to every person in his or her address book.” The virus continues to spread with every person that clicks on the attachment, filling mailboxes and clogging mail servers. A full report is available at ZDNet’s web site (http://zdnet.com.com/2100-11-520435.html?legacy=zdnn). Important note – Microsoft Outlook is a very different program to the Outlook Express email program, but the risk is still there for users of Outlook Express.

For more details on the virus, how it works and how to defeat it visit the McAfee web site )

The virus uses Windows Scripting Host to execute on the client computer once activated. This means that Macintosh users CAN NOT be infected. However, it should be noted that anyone using a Windows Emulator like Virtual PC or a DOS Compatibility card can be affected in those environments.

Macintosh users should also be aware that, even though they can not be infected, they can still distribute the virus to others if they forward the infected email(s). Macintosh users may also be affected if your company and/or ISP are running mail servers that are Windows based PC’s and they are forced to shut down their service. Labyrinth, whom many AUSOM Members use as an ISP, should not have to shut down their mail servers, as I understand they use Unix based mail servers, as do most of the big ISP’s. AUSOM FirstClass should not be affected either.

Now is a good time to ensure you are running the latest version of a virus checker with the latest definitions applied, regardless of if you are a Macintosh or Windows user. Also over the next couple of weeks keep an eye on the various news sites and software update sites for announcements of updates to the various virus checkers.

For Macintosh users, I use and recommend, Virex 6.1, which is available from PICA Software (www.pica.com.au) and all good Macintosh software suppliers. For updates to Virex and other Macintosh software, keep an eye on VersionTracker (www.versiontracker.com)

A few people have asked for suggested solutions for Windows users, which is understandable as they are most likely to be affected. My recommended solution is from McAfee, who have a utility to detect and remove the virus and all known variants. It may be downloaded from;

At this stage, it has been stated that “Given that this worm relies upon Windows technology, such as the Microsoft Registry, this virus will not infect or run on Macintosh computers and so no update to Virex is required.”

However, I personally believe that it should be updated, if for no other reason to give Macintosh users piece of mind that they can’t be affected and that they won’t pass it on. Besides, I actually use Virex 6.1 to scan the Windows NT servers at work, because I have found it to detect and repair Word Macro Viruses better then the virus checker we use on our Windows workstations – Vet.

Once a month, basically the day the Virex Definitions are released, I mount all the NT Server volumes on the Mac desktop and run Virex over them all. On a few occasions, Virex has found and repaired Word Macro viruses that Vet didn’t pick up at all. It is slow scanning across a ten meg ethernet network, compared to scanning a local hard drive, but it has been worth it.

Above all else, you should not panic in any way, just take sensible precautions and you will be fine.

Sensible precautions include;

not opening attachments from sources you don’t know, and/or suspect may be corrupt/infected.

scanning all downloads from the internet before accessing them.

running a current up to date virus checker regularly over your complete system (System, Apps, data, the lot).

Credits

A copy of this article, with colour images, is available from my website, https://www.nicholaspyers.com.

Interested in reprinting this article? Any non-profit Apple Macintosh User Group (MUG) may re-print, free of charge, any of the articles written by Nicholas Pyers found at https://www.nicholaspyers.com/articles. There are just a couple of conditions, which basically boil down to letting us know – for the full terms and conditions, please visit https://www.nicholaspyers.com/reprints.