| s.fowler |
May 4th, 2000 09:33 AM |
Sorry for the spam... but here's more.. <BR> <BR>This is from symantec's website. So it is authentic. <BR> <BR>VBS.LoveLetter.A <BR>This is an email worm, mIRC worm, and file infector. <BR> <BR>Also known as: <BR> <BR>Category: Worm <BR> <BR>Infection length: 10307 <BR>Virus definitions: Pending <BR> <BR>Threat assessment: <BR> <BR>Damage: <BR>High Distribution: <BR>High Wildness: <BR>High <BR> <BR>Wild <BR> <BR>Number of infections: More than 1000 <BR>Number of sites: More than 10 <BR>Geographic distribution: High <BR>Threat containment: Moderate <BR>Removal: Moderate <BR>Damage <BR>Payload: <BR> <BR>Large scale e-mailing: All the addresses in Microsoft Outlook address <BR>book <BR>Degrades performance: May clog mail servers <BR>Distribution <BR> <BR>Subject of e-mail: ILOVEYOU <BR>Name of attachment: LOVE-LETTER-FOR-YOU.TXT.vbs <BR>Size of attachment: 10307 <BR>Technical description: <BR> <BR>This is a preliminary writeup. The information contained within is to <BR>provide as much information as possible at this time. <BR>VBS.LoveLetter.A is an email worm, mIRC worm, and a file infector. <BR>VBS.LoveLetter.A will use Microsoft Outlook and email itself out as an <BR>attachment with the above subject line and attachment name. The body of <BR>the <BR>message will be <BR> <BR>kindly check the attached LOVELETTER coming from me. <BR> <BR>The virus will also infect files with the following extensions: vbs, <BR>vbe, <BR>js, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2 <BR>The virus will insert the following files: <BR> <BR>MSKernel32.vbs in the Windows System directory <BR> <BR>Win32DLL.vbs in the Windows directory <BR> <BR>LOVE-LETTER-FOR-YOU.TXT.vbs in the Windows System directory <BR> <BR>WinFAT32.EXE in the Internet download directory <BR> <BR>WIN-BUGSFIX.EXE in the Internet download directory <BR> <BR>script.ini in the mIRC directory <BR>SARC recommends Administrators filter on the attachment name and Subject <BR>line immediately. <BR> <BR>This writeup will be verified and formalized within the hour. <BR> <BR>Removal: <BR> <BR>Delete found infected files. <BR> <BR>Write-up by: Eric Chien <BR>Updated: May 4, 2000 <BR>Tell a Friend <BR>-------------------------- <BR>
|