LETTER WORM SPREADS RAPIDLY
Virus Name : VBS/LoveLetter
Alias : I-Worm/LoveLetter
Virus type : VB
level : High
VBS/LoveLetter is a VB
Script uses Microsoft outlook and Mirc clients to
spread. It is spreading faster than Melissa
virus. It causes heavy e-mail traffic and downs
many mail servers. The new variant VBS/NewLove charges deadly payload
and it will damage all files in the system.
When opening the e-mail
attachment, will create MSKernel32.vbs,
LOVE-LETTER-FOR-YOU.TXT.VBS files in windows
system folder and Win32Dll.VBS in windows folder. Then it changes the registry settings so that
the the script is automatically executed when the
system is restarted. The .VBS extension will not
appear if windows scripting host is installed.
This worm takes advantage of this and blinds the
user to open attachment.
It opens the Microsoft
Outlook Address book and sends email to all the
email ids stored in that. The message subject
will be "I Love you", the message body
will be "kindly check the attached love
letter coming from me" and the attachment
name will be
"LOVE-LETTER-FOR-YOU.TXT.VBS". Then the
virus searches for all local and remote drives
and overwrites .js, .hta, .css, .wsh, .sct and
.hta files with the script. It overwrites jpg,
jpeg files with the virus code and renames to
.vbs extension. In case of mp2 and mp3 files it
hides the original file and creates a new file
with .vbs extension and writes its code there.
It also tries to download
a file from virus author's site. If the file is
downloaded it modifies the registry to run the
file on each reboot. It is a password stealing
trojan will be stored in the name of
WIN-BUGFIX.EXE. There are several variants of
VBS/LoveLetter is reported in the wild. Most of
them arrives with different names like LOVE-LETTER-FOR-YOU.TXT.VBS, mothersday.vbs,
KillEmAll.TXT.vbs, protect.vbs or
Very Funny.vbs. There
are more than 25 variants reported in the wild
This variant of
VBS/Loveletter mail carries the following
Mothers Day Order Confirmation
Body: We have proceeded to charge your
credit card for the amount of $326.92 for the
mothers day diamond special. We have attached a
detailed invoice to this email. Please print out
the attachment and keep it in a safe place.
Thanks Again and Have a Happy Mothers Day!
Susitikim shi vakara kavos puodukui...
Body: Kindly check the attached LOVE
LETTER coming from me.
This variant is
written in shell script using the VBS/LoveLetter
concept. This variant is not wide spread in the
How can I protect my
Solo has incorporated VBS/LoveLetter
worm and its variants in its signature
file to protect users from this worm attack. Solo
antivirus registered users are already protected
from this worm. Make sure that you have installed
registered version of Solo Antivirus to protect
your system from all virus threats.
To protect your system
against infection, disable Windows Scripting
Host by following these steps: Click the Start
button, Settings, Control Panel, then select
Add/Remove Programs, then select the Windows
Setup tab, then double-click Accessories, scroll
down to Windows Scripting Host, and uncheck the
box. Save changes and close the window.
to remove this worm?
you are already infected with this worm, you can
remove it from your computer using Solo Antivirus
software. Solo antivirus can detect and
remove LoveLetter worm safely. Use the
following link to Download 30 day trial
version of Solo antivirus
remove viruses from your computer.
Solo anti-virus not only
scans for all viruses, it contains a unique System
Integrity Checker to protect you from
New Internet Worms, Backdoors and
malicious VB, Java Scripts. It also
effectively removes all existing Internet Worms,
File viruses, malicious VB, Java scripts,
Trojans, Backdoors, boot sector, partition table
and macro viruses.
purchase Solo antivirus using the link