LoveLetter Virus Information

NetPlus Users Beware! There is a new virus spreading rapidly throughout the internet. If you receive an email with the attachment " LOVE-LETTER-FOR-YOU.TXT.vbs" DO NOT open it. It will infect your system and anyone in your address book. Please read the below information for more on this virus. OR for the latest information on the loveletter virus visit the Symantec site at: http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html

Distribution

• Subject of e-mail: ILOVEYOU
• Name of attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
• Size of attachment: 10307

This is an email worm, mIRC worm, and file infector.

• Payload:
  
  • Large scale e-mailing: All the addresses in Microsoft Outlook address book
  • Degrades performance: May clog mail servers

Technical description:

VBS.LoveLetter.A is an email worm, mIRC worm, and a file infector. VBS.LoveLetter.A will use Microsoft Outlook and email itself out as an attachment with the above subject line and attachment name. The body of the message will be

kindly check the attached LOVELETTER coming from me.

The virus will also infect files with the following extensions: vbs, vbe, js, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2

The virus will insert the following files:

MSKernel32.vbs in the Windows System directory

Win32DLL.vbs in the Windows directory

LOVE-LETTER-FOR-YOU.TXT.vbs in the Windows System directory

WinFAT32.EXE in the Internet download directory

WIN-BUGSFIX.EXE in the Internet download directory

script.ini in the mIRC directory

SARC recommends Administrators filter on the attachment name and Subject line immediately. 

Write-up by: Eric Chien Updated: May 4, 2000