Summary

This variant of Email-Worm:VBS/Loveletter is distributed as an infectious e-mail file attachment.

Additional Details

This variant sends messages with the following content:

Subject: Thank You For Flying With Arab Airlines Body: Please check if the bill is correct, by opening the attached file. Attachment: ArabAir.TXT.vbs
VBS/LoveLetter.K deletes files with ".dll" and ".exe" extensions and creates a new file with an additional ".vbs" extension. Then the virus locates all files with the ".sys" extension, creates a new file with the ".vbs" extension and hides the original file.

[Analysis: Katrin Tocheva, Mikko Hypponen, Alexey Podrezov and Sami Rautiainen, F-Secure]