Researchers at the Symantec AntiVirus Research Center (SARC) have discovered VBS.LoveLetter.A, an extremely fast-spreading computer worm that uses mIRC and Microsoft Outlook to e-mail itself as an attachment.
Characteriscs of infection:
VBS.LoveLetter.A is an Internet worm that uses Microsoft Outlook to spread itself as an attachment with the subject line "ILOVEYOU" along with an attachment called "LOVE-LETTER-FOR-YOU.TXT.vbs."
Payload:
Preliminary finding indicate that the worm sends itself to all addresses in the computer user's Outlook address book causing mail servers to clog. The worm will infect files with the following extensions: vbs, vbe, je, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2.
Additionally, it will delete the following files:
MSKernel32.vbs in the Windows system directory
Win32DLL.vbs in the Windows directory
LOVE-LETTER-FOR-YOU.TXT.vbs in the Windows System directory
WinFAT32.EXE in the Internet download directory
WIN-BUGSFIX.EXE in the Internet download directory
Script.ini in the mIRC directory
Recommendations/Protection:
SARC recommends administrators filter for the attachment name and subject line immediately.
Share
Symantec Antivirus Research Center
Symantec Antivirus Research Center (SARC) is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.