'Navidad' computer virus poses moderate risk

In this story: Delete, delete, delete RELATED STORIES, SITES

SANTA CLARA, California (CNN) -- A new computer virus disguised as an electronic Christmas card is making the rounds, according to the anti-virus software company McAfee. The good news is that it does not seem to destroy data or seriously damage the computers that it infects.

The virus is named "Navidad," which means Christmas in Spanish. It spreads itself exclusively through the Microsoft Outlook and Outlook Express e-mail programs.

	MESSAGE BOARD
Security on the Net

Michael Callahan, McAfee's Director of Product Marketing, said his company has received reports that the new virus has infected computers at 10 Fortune 500 companies, though he would not name any of them. So far, most of the companies and computers affected have been in Latin America.

McAfee has known about Navidad for about a week. It initially classified the virus as "low risk," meaning it was spreading very slowly. On Friday, McAfee upgraded the risk assessment to "medium on watch." That means the virus has started spreading more quickly over a short period of time.

So far, however, it does not appear to be spreading anywhere close to the lightning speed of viruses like "Melissa" or the "ILOVEYOU" virus.

As is the case with many computer viruses, Navidad spreads itself as an e-mail attachment -- in this case labeled "Navidad.exe." Callahan cautions the public not to mistake this e-mail for the kind of electronic Christmas card that has become wildly popular over the past few years. So-called "executable" cards, like "tree.exe," come as "executable" e-mail attachments. When the attached file is opened, the recipient views a short animated "card," complete with music and a holiday greeting.

That is not what the recipient will see upon opening e-mail infected with the Navidad virus.

E-mail with the attached virus will come as a reply to a previously sent e-mail. Most users will not question the legitimacy of the mail because they will have already been corresponding with the sender, and it will look like a perfectly normal reply.

But this reply will have the "Navidad.exe" file attached.

If the recipient double clicks on the "Navidad.exe," the virus displays a box titled "Error" that contains the message "UI." At that point a small blue "eye" icon appears at the lower right had of the computer screen, in what's called the "system tray," next to the clock.

If the recipient places the cursor over the "eye" icon, a text box appears that reads "Lo estamos mirando," or "We are watching it."

If the recipient clicks on the "eye" icon, a button appears that reads "Nunca presionar este boton," which translates to "Never press this button."

If the button is pressed, a message box appears titled "Feliz Navidad," and the content reads "Lamentablemente cayo en la tentacion y perdio su computatora." In English, that means "Merry Christmas. Unfortunately you've given in to temptation and lose your computer."

At that point, the virus installs a program that renders the computer unable to launch any "executable" applications, such as Microsoft Word and Microsoft Excel. The unwanted program can be manually removed from the hard drive, but the casual computer user may find the procedure challenging. Instructions on how to do that are available at www.nai.com.

Otherwise, the virus does not appear to damage the computers it infects. It does, however, spread by mailing a copy of itself to the author of every message in the inbox.

"Nuisance" viruses can cost companies money, even though they do not destroy data or damage computers. Tech support personnel might have to go desk to desk to do fixes, or perform maintenance on e-mail servers that have become clogged with virus-generated messages. That process can cost companies in lost business and productivity. Keeping computers up-to-date with anti-virus software can prevent many virus infections.

No information is available at this time on how much money Navidad may have cost the companies who have reported infections.

New McAfee virus update can freeze some computers
November 7, 2000
Company scans for viruses targeting PDAs, WAP devices
November 3, 2000
Variant of 'I Love You' virus returns
October 24, 2000
Worms can be more problematic than viruses
September 26, 2000
Pennsylvania makes spreading computer viruses criminal
June 1, 2000

McAfee Active Virus Defense

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.