Latest on I Love You mutations
Posted by: hobar <hobar@...>
inboxes yesterday. It gives details on a number of mutations of the LoveBug
worm that I thought might be of interest to all. Personally, I am appalled
at the lengths some will go to in an attempt to be destructive.
** High Priority **
As everyone by now should be aware, the "ILOVEYOU" virus and its many
variants have attacked computers worldwide. The virus mainly affects users
of MS Outlook, MS Outlook Express, MS Office, and MS Internet Explorer
however any computer running Microsoft Windows may be affected and anyone
can pass the virus on by forwarding it.
ILOVEYOU arrives as e-mail with the subject line "I Love You" and an
attachment named "Love-Letter-For-You.txt.vbs". Opening the attachment
infects your computer. Since the first outbreak of the "ILOVEYOU" virus,
many additional variations have been identified, some of which are more
destructive than the original. Every day, more variations are discovered.
Most of the known variations are listed at the bottom of this message.
Known Variations of the ILOVEYOU Virus
Love Bug
Subject Line: ILOVEYOU
Body Text: kindly check the attached LOVELETTER coming from me.
Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
Notes: Also known as
I-Worm.Loveletter,IRC/Loveletter, Loveletter,
Troj/LoveLet-A,VBS.Loveletter.a
Susitikim
Subject line: Susitikim shi vakara kavospuodukui...
Body text: kindly check the attached LOVELETTER coming from me.
Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
Notes: The subject line is Lithuanian for "Let's meet this evening for a cup
of coffee
Joke
Subject Line: Very Funny or Joke
Attachment: Very Funny.vbs or VeryFunny.HTM
Mother's Day
Subject: Mothers Day Order Confirmation
Body: We have proceeded to charge your credit
card for the amount of $326.92 for the
mothersday diamond special. We have
attached a detailed invoice to this email.
Please print out the attachment and keep it in
safe place. Thanks Again and Have a Happy
MothersDay! [email protected]
Attachment: mothersday.vbs
Notes: This variant deletes files with the extension
.ini" and ".bat" as opposed
to ".jpg"and ".jpeg". This means users will be
unable to reboot their machines.
Virus Warning
Subject line: Dangerous Virus Warning
Body text: There is a dangerous virus circulating. Please
click attached picture to view it and learn to
avoid it.
Attachment: virus_warning.jpg.vbs
Notes: also sends Urgent_virus_warning.htm.
Virus ALERT
Subject line: Virus ALERT!!!
Body text: Dear Symantec customer, Symantec's
AntiVirus Research Center began
receiving reports regarding VBS.LoveLetter. A
virus early morning on May 4, 2000
GMT ...also as a quick solution Symantec
Corp. offers VisualBasic Script to protect your
PC against this worm. (See attached.) Note!
when executed, this script will protect Your PC
from being INFECTED by VBS.LoveLetter...
Attachment: protect.vbs
Notes: Even though it says it's from
[email protected], it is not from
Symantec. This variant also overwrites files
with .bat and .com extensions.
Brainstorm
Subject line: Important ! Read carefully !!
Body text: Check the attached IMPORTANT coming from me !
Attachment: IMPORTANT.TXT.vbs
I Cant Believe This!!!
Subject: I Cant Believe This!!!
Body: I Cant Believe I have Just Recieved This
Hate Email .. Take A Look!
Attachment: KillEmAll.TXT.VBS
Notes: Replaces .gif and .bmp files, and hides.wav
and .mid files. It also copies KILER.HTM,
KILLER2.VBS, KILLER1.VBS to the hard
disk.
How to Protect yourself
Subject: How to protect yourself from the ILOVEYOU
bug!
Body: Here's the easy way to fix the love virus.
Attachment: Virus-Protections-Instructions.vbs
Arab Airlines
Subject: Thank You For Flying With Arab Airlines
Body: Please check if the Bill is correct, by opening
the attached file.
Attachment: ArabAir.TXT.vbs
--
*********************************************************************
The name of the Lord is a Strong Tower. The Righteous
run into it and are safe. Proverbs 18:10
Howard A. Grim mailto:[email protected]
*********************************************************************