Information about the original VBS/LoveLetter.A is available at:
http://www.F-Secure.com/v-descs/love.shtml
VBS/LoveLetter.BL spreads in email messages with the following
characteristics:
Subject: Rock the Vote
Body: I thought you would find this interesting :)
Attachment: al_gore.vbs
When the attached file is executed, the worm copies itself to the
Windows System directory as "system32.vbs" and to the Windows
temporary directory as "al_gore.vbs".
Then it sends itself to all recipients listed on all Outlook address
books.
Finally VBS/LoveLetter.BL goes through all hard drives and network
drives, and deletes files with extensions ".asp", ".jpg", ".gif",
".htm", ".html", ".css", ".mp3", ".mp2", ".mod", ".mpeg" or ".mpg".
For each deleted file the worm creates a new file with the ".vbs"
extension to the end of the file name. These files contain the worm
itself.
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure; October 2000]
