This variant of Email-Worm:VBS/Loveletter is distributed as an infectious e-mail file attachment.
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
This variant spreads in a message with the following content:
Subject: fwd: Joke Attachment: Joke.vbs
VBS/LoveLetter.BE@mm is quite similar with the original VBS/LoveLetter.A. This variant saves itself to the Windows System directory as "Jokes.vbs" and "Jokes.htm".
Also this variant uses a different set of extensions, so the files with the following extensions are deleted: ".js", ".zip", ".css", ".doc", ".xls" and ".htm"; and the files with following extensions are hidden: ".mp3" and ".mid". The worm creates a new file using the original file name and a ".vbs" extension for each file that it deletes or hides.
This variant does not spread via mIRC.
Description Created: F-Secure; June 2001
Technical Details: Sami Rautiainen