I actually heard about this first on TV, and came in to try to verify it and saw I had received several email messages, including this one from our own Floyanne Radzinski
|
I received an email this morning from a friend of mine here in Tulsa.
Like a good girl I ran my virus scan on his attachment, called "Virus",
before I opened it. It was OK so I opened it. After reading about an
email problem called "Love Letter" I proceeded to check it out like you
taught us.
I opened TCS Link page and went to "Software" & then the "Virus check" page. I spend five minutes trying to download info but for some reason neither of the places I choose completed a download. Out of curiosity, I called Bank of OK and asked them if they were having trouble with their computers. The operator said, their computers are not down to the best of her knowledge but they are having trouble with their email and the "Love Letter" is a real virus so don't open it. I decided to send this to you in case you want to look into it more. |
I always try to verify any virus report with several of the virus sites,
but had the same problem Floyanne had -- they were all so clogged
with others checking it out so I posted a preliminary notice,
and kept trying, and here are the confirming links:
The worm attempts to send copies of itself through mIRC to the IRC channels as well as through Outlook to all address book entries.
VBS/LoveLetter.worm also attempts to download and install an executable file called WIN-BUGSFIX.EXE, a password stealing program that will email any cached passwords it finds to the mail address MAILME@SUPER.NET.PH.
Another variant that has recently popped up reads "Mothers Day Confirmation Order" in the subject line. The email informs readers that a credit card charge was made for a Mothers Day diamond special and directs them to print out the attachment, which is an order invoice.
The worm attempts to send copies of itself through mIRC to the IRC channels as well as through Outlook to all address book entries.
VBS/LoveLetter.worm also attempts to download and install an executable file called WIN-BUGSFIX.EXE, a password stealing program that will email any cached passwords it finds to the mail address MAILME@SUPER.NET.PH.
Another variant that has recently popped up reads "Mothers Day Confirmation Order" in the subject line. The email informs readers that a credit card charge was made for a Mothers Day diamond special and directs them to print out the attachment, which is an order invoice.
I also have been informed that there is a copycat with a Very Funny.VBS which should not be opened either.
OK all you fans of doom and gloom, this one is for real.
There is a virus out there that has hit my office today, with the subject line "I LOVE YOU".
It is a worm, it works like "Melissa", it is very bad and it will spread itself if you open it and download the attachement.
Here are the details: It looks like the Symantec web site is swamped. Here's the text from a partially downloaded page on the VBS.LoveLetter.A virus:
© 1995-2000 Symantec Corporation. All rights reserved. Legal Notices Privacy Policy
VBS.LoveLetter.A This is an email worm, mIRC worm, and file infector.
Also known as:
Category: Worm
Infection length: 10307
Virus definitions: Pending
Threat assessment:
Damage: High Distribution: High Wildness: High
Wild
Number of infections: More than 1000 Number of sites: More than 10 Geographic distribution: High Threat containment: Moderate Removal: Moderate Damage
Payload:
Large scale e-mailing: All the addresses in Microsoft Outlook address book Degrades performance: May clog mail servers Distribution
Subject of e-mail: ILOVEYOU Name of attachment: LOVE-LETTER-FOR-YOU.TXT.vbs Size of attachment: 10307 Technical description:
This is a preliminary writeup. The information contained within is to provide as much information as possible at this time.
VBS.LoveLetter.A is an email worm, mIRC worm, and a file infector. VBS.LoveLetter.A will use Microsoft Outlook and email itself out as an attachment with the above subject line and attachment name. The body of the message will be
kindly check the attached LOVELETTER coming from me.
The virus will also infect files with the following extensions: vbs, vbe, js, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2
The virus will insert the following files:
MSKernel32.vbs in the Windows System directory
Win32DLL.vbs in the Windows directory
LOVE-LETTER-FOR-YOU.TXT.vbs in the Windows System directory
WinFAT32.EXE in the Internet download directory
WIN-BUGSFIX.EXE in the Internet download directory
script.ini in the mIRC directory
SARC recommends Administrators filter on the attachment name and Subject line immediately.
This writeup will be verified and formalized within the hour.
Removal:
Delete found infected files.
Previous TCS Virus Alerts: