Security

Exterminator: ILOVEYOU worm takes on the world

Sure you've heard about the ILOVEYOU worm, but do you know about all of the copycats out there? This week, the Exterminator takes a look at ILOVEYOU and its variants.


Get rid of your bugs and worms with Exterminator by your side!
Exterminator takes a special look this week at the worm everyone knows as the ILOVEYOU virus. Are you aware that there are copycats out there as well? Exterminator has them all here for you, thanks to Symantec’s AntiVirus Research Center!

No more ILOVEYOUs?
Unfortunately, this worm didn’t stop with ILOVEYOU. Currently, there are 29 variations of the worm out in the world as of the time of this column’s publication. Below, you will see a list of these variations, the attachment name, the subject line, and body message within the e-mail, as provided by Symantec’s AntiVirus Research Center. Visit the Research Center for more in-depth information regarding this worm.

VBS.LoveLetter.A
Norton AntiVirus detects as: VBS.LoveLetter.A(1)
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.

VBS.LoveLetter.B (also known as Lithuania)
Norton AntiVirus detects as: VBS.LoveLetter.B(1)
ATTACHMENT: same as A
SUBJECT LINE: Susitikim shi vakara kavos puodukui...
MESSAGE BODY: same as A

VBS.LoveLetter.C (also known as Very Funny)
Norton AntiVirus detects as: VBS.LoveLetter.C(1)
ATTACHMENT: Very Funny.vbs
SUBJECT LINE: fwd: Joke
MESSAGE BODY:empty

VBS.LoveLetter.D (also known as BugFix)
Norton AntiVirus detects as: VBS.LoveLetter.A(1)
ATTACHMENT: same as A
SUBJECT LINE: same as A
MESSAGE BODY: same as A
MISC. NOTES: registry entry: WIN- -BUGSFIX.exe instead of WIN-BUGSFIX.exe

VBS.LoveLetter.E (also known as Mother's Day)
Norton AntiVirus detects as: VBS.LoveLetter.E
ATTACHMENT: mothersday.vbs
SUBJECT LINE: Mothers Day Order Confirmation
MESSAGE BODY: We have proceeded to charge your credit card for the amount of $326.92 for the mothers day diamond special. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place. Thanks Again and Have a Happy Mothers Day! mothersday@subdimension.com
MISC. NOTES: mothersday.HTM sent in IRC, & comment: rem hackers.com, & start up page to hackes.com, l0pht.com, or 2600.com

VBS.LoveLetter.F (also known as Virus Warning)
Norton AntiVirus detects as: VBS.LoveLetter.F
ATTACHMENT: virus_warning.jpg.vbs
SUBJECT LINE: Dangerous Virus Warning
MESSAGE BODY: There is a dangerous virus circulating. Please click attached picture to view it and learn to avoid it.
MISC. NOTES: Urgent_virus_warning.htm

VBS.LoveLetter.G (also known as Virus ALERT!!!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant or VBS.LoveLetter.G
ATTACHMENT: protect.vbs
SUBJECT LINE: Virus ALERT!!!
MESSAGE BODY: a long message regarding VBS.LoveLetter.A
MISC. NOTES: FROM support@symantec.com. This variant also overwrites files with .bat and .com extensions.

VBS.LoveLetter.H (also known as No Comments)
Norton AntiVirus detects as: VBS.LoveLetter.A
ATTACHMENT: same as A
SUBJECT LINE: same as A
MESSAGE BODY: same as A
MISC. NOTES: the comment lines at the beginning of the worm code have been removed.

VBS.LoveLetter.I (also known as Important! Read carefully!!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Important.TXT.vbs
SUBJECT LINE: Important! Read carefully!!
MESSAGE BODY: Check the attached IMPORTANT coming from me!
MISC. NOTES: new comment line at the beginning: by: BrainStorm / @ElectronicSouls. It also copies the files ESKernel32.vbs & ES32DLL.vbs, and MIRC script comments referring to BrainStorm and ElectronicSouls and sends IMPORTANT.HTM to the chat room.

VBS.LoveLetter.J
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: protect.vbs
SUBJECT LINE: Virus ALERT!!!
MESSAGE BODY:Largely the same as the G variant.
MISC. NOTES: This appears to be a slight modification of the G variant.

VBS.LoveLetter.K
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Virus-Protection-Instructions.vbs
SUBJECT LINE: How to protect yourself from the IL0VEY0U bug!
MESSAGE BODY: Here's the easy way to fix the love virus.
MISC. NOTES:

VBS.LoveLetter.L (I Cant Believe This!!!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: KillEmAll.TXT.VBS
SUBJECT LINE: I Cant Believe This!!!
MESSAGE BODY: I Cant Believe I have Just Recieved This Hate Email .. Take A Look!
MISC. NOTES: comment has phrase/words: Killer, by MePhiston, replaces GIF & BMP instead of JPG & JPEG, hides WAV & MID instead of MP3 & MP2. NO IRC routine, there it will not infect chat room users. Copies KILER.HTM, KILLER2.VBS, KILLER1.VBS to the hard disk.

VBS.LoveLetter.M (Arab Air)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: ArabAir.TXT.vbs
SUBJECT LINE: Thank You For Flying With Arab Airlines
MESSAGE BODY: Please check if the bill is correct, by opening the attached file
MISC. NOTES: Replaces DLL & EXE files instead of JPG & JPEG. Hides SYS & DLL files instead of MP3 & MP2. Copies no-hate-FOR-YOU.HTM to the hard disk.

VBS.LoveLetter.N (also known as Variant Test)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: IMPORTANT.TXT.vbs
SUBJECT LINE: Variant Test
MESSAGE BODY: This is a variant to the vbs virus.
MISC. NOTES: Copies itself as sndvol32.vbs and IEAKDLL.vbs. Internet Explorer start page changed to http://altalavista.box.sk. It does not download the password stealing trojan. Overwrites *.mpg, *.mpeg, *.avi, *.qt, *.qtm. Sends the file important.htm into Internet chat rooms via mIRC.

VBS.LoveLetter.O (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: The file script.ini, which it sends into Internet chat rooms, has a modified comment line.

VBS.LoveLetter.P (also known as Yeah Yeah)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Vir-Killer.vbs
SUBJECT LINE: Yeah, Yeah another time to DEATH...
MESSAGE BODY: This is the Killer for VBS.LOVE-LETTER.WORM.
MISC. NOTES: Sets the Internet Explorer start page to http://www.yahoo.com/Vir-Killer.exe. It does not download the password stealing trojan. Overwrites *.ZIP and *.RAR files instead of *.JPG and *.JPEG file. Hides *.PAS and *.ASM files instead of *.MP3 and *.MP2

VBS.LoveLetter.Q (also known as LOOK!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOOK.vbs
SUBJECT LINE: LOOK!
MESSAGE BODY: hehe...check this out.
MISC. NOTES: Copies itself as MSUser32.vbs and User32DLL.vbs. Overwrites *.XLS and *.MDB files instead of *.JPG and *.JPEG. Hides *.EXE and *.LNK instead of *.MP3 and *.MP2. Creates LOOK.HTM

VBS.LoveLetter.R (also known as Bewerbung)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: BEWERBUNG.TXT.vbs
SUBJECT LINE: Bewerbung Kreolina
MESSAGE BODY: Sehr geehrte Damen und Herren!
MISC. NOTES: IRC sends BEWERBUNG.HTM into connected Internet chat room.

VBS.LoveLetter.S (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: Several comment lines have been added.

VBS.LoveLetter.T (BAND-AID)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: : BAND-AID.DOC.VBS
SUBJECT LINE: Recent Virus Attacks-Fix
MESSAGE BODY: Attached is a copy of a script that will reverse the effects of the LOVE-LETTER-TO-YOU.TXT.vbs as well as the FW:JOKE, Mother's Day and Lithuanian siblings.
MISC. NOTES: Sets Internet Explorer start page set to a virus-related web site. Deletes files with .BAT, .GIF, .TIF, .TIFF, .WAV, .LNK, .BAK, .DOC, .XLS, .RTF, .TXT, .HTM, .HTML, .XML, .MNY, .ZIP, .BMP, .CAB, and .INF extensions. It doesn't hide MP3 and MP2 files but deletes them. Uses mIRC to send BAND-AID.HTM into Internet chat rooms.

VBS.LoveLetter.U (Presente)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: UOL.TXT.vbs
SUBJECT LINE: PresenteUOL
MESSAGE BODY: O UOL tem um grande presente para voce, e eh exclusivo.Veja o arquivo em anexo. Http://www.uol.com.br
MISC. NOTES: Sets Internet Explorer start page to http://www.uol.com.br. It also hides .EXE, .COM, and .INI files. Uses mIRC to send UOL.HTM into Internet chat rooms.

VBS.LoveLetter.V (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: Several comment lines have been added.

VBS.LoveLetter.W (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Bug and virus fix.vbs
SUBJECT LINE: IMPORTANT: Official virus and bug fix
MESSAGE BODY: This is an official virus and bug fix. I got it from our system admin. It may take a short while to update your system files after you run the attachment.
MISC. NOTES: Sets Internet Explorer Start page to a virus-related site. Overwrites files with the following extensions: .EXE, .COM, .DLL, .SYS, .PWL, .TXT. Uses mIRC to send "Bug and virus fix.htm" into Internet chat rooms.

VBS.LoveLetter.X (ANTI-VIRUS-LISTE)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: ANTI-VIRUS-LISTE.TXT.vbs
SUBJECT LINE: NEUE ANTI-VIRUS-LISTE
MESSAGE BODY: Hiermit senden wir Ihnen/Dir eine neue Liste mit LOVE-LETTER-VIRUS Namen, die nicht geoeffnet werden sollten, bitte sofort lesen, danke.
MISC. NOTES: Overwrites files with the following extensions: .MDB, .PDF, .WSH, .DOT, .HTA, .JS, .DRV, .INI. Hides files with the following extensions: .XLS, .DOC. Uses mIRC to send "ANTI-VIRUS-LISTE.HTM" into Internet chat rooms.

VBS.LoveLetter.Y (LOOK! 2)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOOK.vbs
SUBJECT LINE: LOOK!
MESSAGE BODY: hehe...check this out.
MISC. NOTES: similar to Q variant but Hides MP3 and MP2

VBS.LoveLetter.Z (BUG & VIRUS FIX)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: MAJOR BUG & VIRUS FIX.vbs
SUBJECT LINE: BUG & VIRUS FIX
MESSAGE BODY: I got this from our system admin. Run this to help pervent any recent or future bug & virus attack's. It may take a small while up update your files.
MISC. NOTES: Sets Internet Explorer Start Page to a virus-related site. Overwrites files with the extensions .COM, .DLL, .EXE, .TXT, .BAT, .SYS. Uses mIRC to send "BUG & VIRUS FIX.HTM" into Internet chat rooms.

VBS.LoveLetter.AA (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: Several comment lines have been added.

VBS.LoveLetter.AB (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: a few lines of comment and instructions have been removed.

VBS.LoveLetter.AC (antivirusupdate)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: antivirusupdate.vbs
SUBJECT LINE: New Variation on LOVEBUG Update Anti-Virus!!
MESSAGE BODY: There is now a newer variant of love bug. It was released at 8:37 PM Saturday Night. Please Download the following patch. We are trying to isolate the virus. Thanks Symantec."
MISC. NOTES: Several comment lines have been modified. Uses mIRC to send antivirusupdate.htm into Internet chat rooms.

Share your ILOVEYOU horror stories!
Have you had problems with the ILOVEYOU virus or one of its variations? If so, we’d like to hear about it. Feel free to post a message below or send us a note.

 

Get rid of your bugs and worms with Exterminator by your side!
Exterminator takes a special look this week at the worm everyone knows as the ILOVEYOU virus. Are you aware that there are copycats out there as well? Exterminator has them all here for you, thanks to Symantec’s AntiVirus Research Center!

No more ILOVEYOUs?
Unfortunately, this worm didn’t stop with ILOVEYOU. Currently, there are 29 variations of the worm out in the world as of the time of this column’s publication. Below, you will see a list of these variations, the attachment name, the subject line, and body message within the e-mail, as provided by Symantec’s AntiVirus Research Center. Visit the Research Center for more in-depth information regarding this worm.

VBS.LoveLetter.A
Norton AntiVirus detects as: VBS.LoveLetter.A(1)
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.

VBS.LoveLetter.B (also known as Lithuania)
Norton AntiVirus detects as: VBS.LoveLetter.B(1)
ATTACHMENT: same as A
SUBJECT LINE: Susitikim shi vakara kavos puodukui...
MESSAGE BODY: same as A

VBS.LoveLetter.C (also known as Very Funny)
Norton AntiVirus detects as: VBS.LoveLetter.C(1)
ATTACHMENT: Very Funny.vbs
SUBJECT LINE: fwd: Joke
MESSAGE BODY:empty

VBS.LoveLetter.D (also known as BugFix)
Norton AntiVirus detects as: VBS.LoveLetter.A(1)
ATTACHMENT: same as A
SUBJECT LINE: same as A
MESSAGE BODY: same as A
MISC. NOTES: registry entry: WIN- -BUGSFIX.exe instead of WIN-BUGSFIX.exe

VBS.LoveLetter.E (also known as Mother's Day)
Norton AntiVirus detects as: VBS.LoveLetter.E
ATTACHMENT: mothersday.vbs
SUBJECT LINE: Mothers Day Order Confirmation
MESSAGE BODY: We have proceeded to charge your credit card for the amount of $326.92 for the mothers day diamond special. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place. Thanks Again and Have a Happy Mothers Day! mothersday@subdimension.com
MISC. NOTES: mothersday.HTM sent in IRC, & comment: rem hackers.com, & start up page to hackes.com, l0pht.com, or 2600.com

VBS.LoveLetter.F (also known as Virus Warning)
Norton AntiVirus detects as: VBS.LoveLetter.F
ATTACHMENT: virus_warning.jpg.vbs
SUBJECT LINE: Dangerous Virus Warning
MESSAGE BODY: There is a dangerous virus circulating. Please click attached picture to view it and learn to avoid it.
MISC. NOTES: Urgent_virus_warning.htm

VBS.LoveLetter.G (also known as Virus ALERT!!!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant or VBS.LoveLetter.G
ATTACHMENT: protect.vbs
SUBJECT LINE: Virus ALERT!!!
MESSAGE BODY: a long message regarding VBS.LoveLetter.A
MISC. NOTES: FROM support@symantec.com. This variant also overwrites files with .bat and .com extensions.

VBS.LoveLetter.H (also known as No Comments)
Norton AntiVirus detects as: VBS.LoveLetter.A
ATTACHMENT: same as A
SUBJECT LINE: same as A
MESSAGE BODY: same as A
MISC. NOTES: the comment lines at the beginning of the worm code have been removed.

VBS.LoveLetter.I (also known as Important! Read carefully!!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Important.TXT.vbs
SUBJECT LINE: Important! Read carefully!!
MESSAGE BODY: Check the attached IMPORTANT coming from me!
MISC. NOTES: new comment line at the beginning: by: BrainStorm / @ElectronicSouls. It also copies the files ESKernel32.vbs & ES32DLL.vbs, and MIRC script comments referring to BrainStorm and ElectronicSouls and sends IMPORTANT.HTM to the chat room.

VBS.LoveLetter.J
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: protect.vbs
SUBJECT LINE: Virus ALERT!!!
MESSAGE BODY:Largely the same as the G variant.
MISC. NOTES: This appears to be a slight modification of the G variant.

VBS.LoveLetter.K
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Virus-Protection-Instructions.vbs
SUBJECT LINE: How to protect yourself from the IL0VEY0U bug!
MESSAGE BODY: Here's the easy way to fix the love virus.
MISC. NOTES:

VBS.LoveLetter.L (I Cant Believe This!!!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: KillEmAll.TXT.VBS
SUBJECT LINE: I Cant Believe This!!!
MESSAGE BODY: I Cant Believe I have Just Recieved This Hate Email .. Take A Look!
MISC. NOTES: comment has phrase/words: Killer, by MePhiston, replaces GIF & BMP instead of JPG & JPEG, hides WAV & MID instead of MP3 & MP2. NO IRC routine, there it will not infect chat room users. Copies KILER.HTM, KILLER2.VBS, KILLER1.VBS to the hard disk.

VBS.LoveLetter.M (Arab Air)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: ArabAir.TXT.vbs
SUBJECT LINE: Thank You For Flying With Arab Airlines
MESSAGE BODY: Please check if the bill is correct, by opening the attached file
MISC. NOTES: Replaces DLL & EXE files instead of JPG & JPEG. Hides SYS & DLL files instead of MP3 & MP2. Copies no-hate-FOR-YOU.HTM to the hard disk.

VBS.LoveLetter.N (also known as Variant Test)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: IMPORTANT.TXT.vbs
SUBJECT LINE: Variant Test
MESSAGE BODY: This is a variant to the vbs virus.
MISC. NOTES: Copies itself as sndvol32.vbs and IEAKDLL.vbs. Internet Explorer start page changed to http://altalavista.box.sk. It does not download the password stealing trojan. Overwrites *.mpg, *.mpeg, *.avi, *.qt, *.qtm. Sends the file important.htm into Internet chat rooms via mIRC.

VBS.LoveLetter.O (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: The file script.ini, which it sends into Internet chat rooms, has a modified comment line.

VBS.LoveLetter.P (also known as Yeah Yeah)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Vir-Killer.vbs
SUBJECT LINE: Yeah, Yeah another time to DEATH...
MESSAGE BODY: This is the Killer for VBS.LOVE-LETTER.WORM.
MISC. NOTES: Sets the Internet Explorer start page to http://www.yahoo.com/Vir-Killer.exe. It does not download the password stealing trojan. Overwrites *.ZIP and *.RAR files instead of *.JPG and *.JPEG file. Hides *.PAS and *.ASM files instead of *.MP3 and *.MP2

VBS.LoveLetter.Q (also known as LOOK!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOOK.vbs
SUBJECT LINE: LOOK!
MESSAGE BODY: hehe...check this out.
MISC. NOTES: Copies itself as MSUser32.vbs and User32DLL.vbs. Overwrites *.XLS and *.MDB files instead of *.JPG and *.JPEG. Hides *.EXE and *.LNK instead of *.MP3 and *.MP2. Creates LOOK.HTM

VBS.LoveLetter.R (also known as Bewerbung)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: BEWERBUNG.TXT.vbs
SUBJECT LINE: Bewerbung Kreolina
MESSAGE BODY: Sehr geehrte Damen und Herren!
MISC. NOTES: IRC sends BEWERBUNG.HTM into connected Internet chat room.

VBS.LoveLetter.S (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: Several comment lines have been added.

VBS.LoveLetter.T (BAND-AID)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: : BAND-AID.DOC.VBS
SUBJECT LINE: Recent Virus Attacks-Fix
MESSAGE BODY: Attached is a copy of a script that will reverse the effects of the LOVE-LETTER-TO-YOU.TXT.vbs as well as the FW:JOKE, Mother's Day and Lithuanian siblings.
MISC. NOTES: Sets Internet Explorer start page set to a virus-related web site. Deletes files with .BAT, .GIF, .TIF, .TIFF, .WAV, .LNK, .BAK, .DOC, .XLS, .RTF, .TXT, .HTM, .HTML, .XML, .MNY, .ZIP, .BMP, .CAB, and .INF extensions. It doesn't hide MP3 and MP2 files but deletes them. Uses mIRC to send BAND-AID.HTM into Internet chat rooms.

VBS.LoveLetter.U (Presente)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: UOL.TXT.vbs
SUBJECT LINE: PresenteUOL
MESSAGE BODY: O UOL tem um grande presente para voce, e eh exclusivo.Veja o arquivo em anexo. Http://www.uol.com.br
MISC. NOTES: Sets Internet Explorer start page to http://www.uol.com.br. It also hides .EXE, .COM, and .INI files. Uses mIRC to send UOL.HTM into Internet chat rooms.

VBS.LoveLetter.V (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: Several comment lines have been added.

VBS.LoveLetter.W (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Bug and virus fix.vbs
SUBJECT LINE: IMPORTANT: Official virus and bug fix
MESSAGE BODY: This is an official virus and bug fix. I got it from our system admin. It may take a short while to update your system files after you run the attachment.
MISC. NOTES: Sets Internet Explorer Start page to a virus-related site. Overwrites files with the following extensions: .EXE, .COM, .DLL, .SYS, .PWL, .TXT. Uses mIRC to send "Bug and virus fix.htm" into Internet chat rooms.

VBS.LoveLetter.X (ANTI-VIRUS-LISTE)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: ANTI-VIRUS-LISTE.TXT.vbs
SUBJECT LINE: NEUE ANTI-VIRUS-LISTE
MESSAGE BODY: Hiermit senden wir Ihnen/Dir eine neue Liste mit LOVE-LETTER-VIRUS Namen, die nicht geoeffnet werden sollten, bitte sofort lesen, danke.
MISC. NOTES: Overwrites files with the following extensions: .MDB, .PDF, .WSH, .DOT, .HTA, .JS, .DRV, .INI. Hides files with the following extensions: .XLS, .DOC. Uses mIRC to send "ANTI-VIRUS-LISTE.HTM" into Internet chat rooms.

VBS.LoveLetter.Y (LOOK! 2)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOOK.vbs
SUBJECT LINE: LOOK!
MESSAGE BODY: hehe...check this out.
MISC. NOTES: similar to Q variant but Hides MP3 and MP2

VBS.LoveLetter.Z (BUG & VIRUS FIX)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: MAJOR BUG & VIRUS FIX.vbs
SUBJECT LINE: BUG & VIRUS FIX
MESSAGE BODY: I got this from our system admin. Run this to help pervent any recent or future bug & virus attack's. It may take a small while up update your files.
MISC. NOTES: Sets Internet Explorer Start Page to a virus-related site. Overwrites files with the extensions .COM, .DLL, .EXE, .TXT, .BAT, .SYS. Uses mIRC to send "BUG & VIRUS FIX.HTM" into Internet chat rooms.

VBS.LoveLetter.AA (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: Several comment lines have been added.

VBS.LoveLetter.AB (same as A version)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE: ILOVEYOU
MESSAGE BODY: kindly check the attached LOVELETTER coming from me.
MISC. NOTES: a few lines of comment and instructions have been removed.

VBS.LoveLetter.AC (antivirusupdate)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: antivirusupdate.vbs
SUBJECT LINE: New Variation on LOVEBUG Update Anti-Virus!!
MESSAGE BODY: There is now a newer variant of love bug. It was released at 8:37 PM Saturday Night. Please Download the following patch. We are trying to isolate the virus. Thanks Symantec."
MISC. NOTES: Several comment lines have been modified. Uses mIRC to send antivirusupdate.htm into Internet chat rooms.

Share your ILOVEYOU horror stories!
Have you had problems with the ILOVEYOU virus or one of its variations? If so, we’d like to hear about it. Feel free to post a message below or send us a note.

 

Editor's Picks

Free Newsletters, In your Inbox