"Mawanella" worm sends political message

[TamilNet, Friday, 18 May 2001, 09:16 GMT]
Hundreds of companies worldwide have fallen prey to another mass-mailing worm called 'Mawanella'‚ after the Sri Lankan village, press reports said Thursday. The worm carries a message protesting the attacks on Muslims, but does no real damage besides clogging networks with e-mail, the report by CNET News.com said.

The worm has mainly affected companies in Australia and Europe, Vincent Gullotto, director of the antivirus emergency response team at security company Network Associates, was quoted by CNET as saying.

"We got lots of reports coming in throughout Europe within a two- or three-hour period," he said. "While it's blasted Europe, it's been spotty in the U.S."

In total, Network Associates received more than 100 reports of virus infections from companies worldwide. Clients of Network Associates rival Symantec, the antivirus software maker, submitted a similar number of reports, Symantec said.

The worm comes attached to an e-mail message disguised as a note from a friend or colleague. When opened on a system with Microsoft Outlook installed, the attachment--Mawanella.vbs--sends a copy of itself to every entry in the address book.

After the mass mailing, the virus will bring up a dialog box with the message:

"Mawanella is one of the Sri Lanka's Muslim Village. This brutal incident happened here 2 Moslem Mosques & 100 Shops are burnt. I hat this incident, What about you? I can destroy your computer. I didn't do that because I am a peace-loving citizen."

The message appears on every Windows 9x, NT and 2000 machine infected by the virus, even if Outlook is not installed.

"It's one of the ones that is sociopolitical; I'm not sure if there has ever been one from Sri Lanka, but it's typical," said Vincent Weafer, director of Symantec's antivirus research center. "It is someone who wants to get a message out."

"I do expect that this one will have a fairly short life," he said.