This variant of Email-Worm:VBS/Loveletter is distributed as an infectious e-mail file attachment.
Disinfection & Removal
This variant sends messages with the following content:
Subject: Thank You For Flying With Arab Airlines Body: Please check if the bill is correct, by opening the attached file. Attachment: ArabAir.TXT.vbs
VBS/LoveLetter.K deletes files with ".dll" and ".exe" extensions and creates a new file with an additional ".vbs" extension. Then the virus locates all files with the ".sys" extension, creates a new file with the ".vbs" extension and hides the original file.
Technical Details: Katrin Tocheva, Mikko Hypponen, Alexey Podrezov and Sami Rautiainen, F-Secure