Information about the original VBS/LoveLetter.A is available at:
http://www.F-Secure.com/v-descs/love.shtml
This variant spreads in a message with the following content:
Subject: fwd: Joke
Attachment: Joke.vbs
VBS/LoveLetter.BE@mm is quite similar with the original
VBS/LoveLetter.A. This variant saves itself to the Windows System
directory as "Jokes.vbs" and "Jokes.htm".
Also this variant uses a different set of extensions, so the files
with the following extensions are deleted: ".js", ".zip", ".css",
".doc", ".xls" and ".htm"; and the files with following extensions are
hidden: ".mp3" and ".mid". The worm creates a new file using the
original file name and a ".vbs" extension for each file that it
deletes or hides.
This variant does not spread via mIRC.
[Analysis: Sami Rautiainen, F-Secure; June 2001]
