'Romeo and Juliet' Virus Strikes MS Outlook

A new virus known as "Romeo and Juliet" is spreading among Microsoft Outlook users in Europe and North America. But experts say the love-themed virus doesn't pack the same kiss of death as the more infamous "Love Bug" virus. Like "Love Bug,"

"Romeo and Juliet" is a worm, a self-replicating program that does not alter files but resides in a PC's active memory and duplicates itself by means of computer networks. According to the Symantec AntiVirus Research Center, the worm, which was detected on November 15, has not spread quickly and poses a low threat to computer users. Also known as W32/Verona and Troj Blebla.A, the worm only affects Windows 95, Windows 98, and Windows 2000 systems that have not been updated with the latest vulnerability patches from Microsoft. According to SARC, the worm arrives as an email that has an HTML body and two attachments named myjuliet.chm and myromeo.exe.

The worm comes with one of several subject lines randomly selected from the following list: Romeo&Juliet The worm may annoy everyone in your address book, but it won't harm your system :)))))) hello world !!??!?!? subject ble bla bee I Love You ;), sorry... Matrix has you... my picture from shake-beer Hey you!

Once the user reads the message, the HTML component instructs the attachments to be saved in the Windows\Temp directory on a PC's hard drive. The worm then tries to send itself out to all of the names in a user's Outlook address book. It operates on several Internet mail servers, which SARC has traced to Poland. The worm may annoy everyone in your address book, but it won't harm your system. It has not brought any servers down so far, SARC says.

To protect their computers, SARC recommends that PC users delete all files detected as "W32.Blebla.Worm," as well as any unexpected attachments that show up in their inboxes. SARC says Microsoft Outlook users should also be on the lookout for the far more dangerous "Navidad" virus that has been circulating of late. That virus arrives as a reply when a user sends an email to an infected computer. When executed, "Navidad" renders the machine unusable.