Symantec provides the following information on the VBS.LoveLetter.A
worm:
This is a preliminary write-up. The information contained within
is to provide as much information as possible at this time.
VBS.LoveLetter.A is an email worm, mIRC worm, and a file
infector. VBS.LoveLetter.A will use Microsoft Outlook and
email itself out as an attachment with the above subject line and
attachment name. The body of the message will be
kindly check the attached LOVELETTER coming from me.
The virus will also infect files with the following extensions: vbs,
vbe, js, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2
The virus will insert the following files:
MSKernel32.vbs in the Windows System directory
Win32DLL.vbs in the Windows directory
LOVE-LETTER-FOR-YOU.TXT.vbs in the Windows
System directory
WinFAT32.EXE in the Internet download directory
WIN-BUGSFIX.EXE in the Internet download directory
script.ini in the mIRC directory
SARC recommends Administrators filter on the attachment
name and Subject line immediately.
Removal: Delete found infected files.
Bob
This archive was generated by hypermail 2b29 : Thu May 04 2000 - 09:35:12 PDT