National Infrastructure Protection Center (NIPC) Alert 00-041c
    (LOVE-LETTER-FOR-YOU) Also known as the LOVE BUG VIRUS and variants;
                     UPDATE as of 2000 (EDT) 6 May 2000
                                      
   As of 6 May 2000, at least nine variants of the LOVE BUG worm have
   been identified. These variants may behave differently than the
   original worm and may impact different files. Preliminary information
   on variants is provided below:
   
   A. VBS.LoveLetter.A
   Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
   Subject: ILOVEYOU
   Message Body: kindly check the attached LOVELETTER coming from me.
   
   B. VBS.LoveLetter.B (also known as Lithuania)
   Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
   Subject: Susitikim shi vakara kavos puodukui...
   Message Body: kindly check the attached LOVELETTER coming from me.
   
   C. VBS.LoveLetter.C (also known as Very Funny)
   Attachment: Very Funny.vbs
   Subject: fwd: Joke
   Message Body: (empty)
   
   D. VBS.LoveLetter.D (also known as BugFix)
   Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
   Subject: ILOVEYOU
   Message Body: kindly check the attached LOVELETTER coming from me.
   
   E. VBS.LoveLetter.E (also known as Mother's Day)
   Attachment: mothersday.vbs
   Subject: Mothers Day Order Confirmation
   Message Body: We have proceeded to charge your credit card for the
   amount of $326.92 for the mothers day diamond special. We have
   attached a detailed invoice to this email. Please print out the
   attachment and keep it in a safe place. Thanks Again and have a Happy
   Mothers Day!
   mothersday@subdimension.com
   
   F. VBS.LoveLetter.F (also known as Virus Warning)
   Attachment: virus_warning.jpg.vbs
   Subject: Dangerous Virus Warning
   Message Body: There is a dangerous virus circulating. Please click
   attached picture to view it and learn to avoid it.
   
   G. VBS.LoveLetter.G (also known as Virus ALERT!!!)
   Attachment: protect.vbs
   Subject: Virus ALERT!!!
   Message Body: (contains a lengthy message regarding the LOVE BUG
   Virus)
   NOTE: This email poses as a message from Symantec Technical Support.
   "FROM support@symantec.com."
   This variant also overwrites files with .bat and .com extensions.
   H. VBS.LoveLetter.H (also known as No Comments)
   Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
   Subject: ILOVEYOU
   Message Body: kindly check the attached LOVELETTER coming from me.
   I. VBS.LoveLetter.I (also known as Important! Read carefully!!)
   Attachment: Important.TXT.vbs
   Subject: Important! Read carefully!!
   Message Body: Check the attached IMPORTANT coming from me!
   
   Major Anti-Virus vendors have posted software to detect and prevent
   infection by these variants. Affected users should contact their
   anti-virus software website frequently for updated information and
   patches.
   
   BACKGROUND: On May 4, 2000, the NIPC received reports on and began
   investigating the propagation of a worm entitled "ILOVEYOU" that has
   infected government and private industry systems worldwide. The worm
   first appeared throughout Asia and quickly spread: at least 20
   countries have reportedly been affected. New variants of this worm
   have been discovered. Users are strongly advised to consult frequently
   their anti-virus software vendors' websites for updates of
   inoculations and stay apprised of alerts from NIPC, CERT, and other
   competent sources.
   
   The original version of the worm is distributed to users in the form
   of an email message with an attachment called
   LOVE-LETTER-FOR-YOU.TXT.VBS. On a default Windows system, the ".vbs"
   extension may not be visible, leading users to mistake the file as a
   text file (.txt). (If the user discovers files named MSKernal32.vbs,
   WIN32DLL.vbs, or WIN-BUGSFIX.exe, his/her file is infected.) Once the
   attachment is opened, the worm will use Microsoft Outlook (if
   installed) to send the following message to everyone in the user's
   address book:
   
   From: [Name-of-the-infected-user]
   To: [Name-from-the-address-book]
   Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
   Subject: ILOVEYOU
   Message Body: Kindly check the attached LOVELETTER coming from me.
   
   This worm also propagates via the windows-based Internet Relay Chat
   (IRC) client mIRC, if installed. The worm creates an IRC script,
   called script.ini, which uses direct chat connection (DCC) within IRC
   to send copies of itself in html format to other IRC users. In
   addition to overloading email servers, this worm infects the following
   types of files on the victim's machine as well as files on shared
   directories for which the user has "write access":
   .vbs .js
   .vbe .jse
   .css .wsh
   .sct .hta
   .jpg .jpeg
   .mp2 .mp3
   
   In addition, there are indications that the worm can capture affected
   caches and transfer that information to a third party.
   
   The FBI has opened an investigation into this activity. NIPC alerts
   and additional information on this worm, as they become available,
   will be posted to the NIPC's webpage. Please report any evidence of
   infection to your local FBI office, NIPC, military, or civilian
   computer incident response group, as appropriate. The NIPC Watch and
   Warning Unit can be reached at (202) 323-3204/5/6.
     _________________________________________________________________
                                      
               [ [1]Back to Advisories, Alerts and Warnings ]

References

   1. http://www.fbi.gov/nipc/nipcaaw.htm