Summary

This variant of Email-Worm:VBS/Loveletter is distributed as an infectious e-mail file attachment.

Additional Details

This variant spreads in a message with the following content:

Subject: fwd: Joke Attachment: Joke.vbs
VBS/LoveLetter.BE@mm is quite similar with the original VBS/LoveLetter.A. This variant saves itself to the Windows System directory as "Jokes.vbs" and "Jokes.htm".

Also this variant uses a different set of extensions, so the files with the following extensions are deleted: ".js", ".zip", ".css", ".doc", ".xls" and ".htm"; and the files with following extensions are hidden: ".mp3" and ".mid". The worm creates a new file using the original file name and a ".vbs" extension for each file that it deletes or hides.

This variant does not spread via mIRC.

[Analysis: Sami Rautiainen, F-Secure; June 2001]