Information about the original VBS/LoveLetter.A is available at:
http://www.F-Secure.com/v-descs/love.shtml
This variant spreads in e-mails with the following content:
Subject: Recent Virus Attacks-Fix
Body: Attached is a copy of a script that will reverse the
effects of the LOVE-LETTER-TO-YOU.TXT.vbs as well as
the FW:JOKE, Mother's Day and Lithuanian Siblings.
Attachment: BAND-AID.DOC.vbs
It replaces files with extensions ".bat", ".gif", ".tif", ".tiff",
".wav", ".mp2", ".mp3", ".lnk", ".bak", ".doc", ".xls", ".rtf",
".txt", ".htm", ".html", ".xml", ".mny", ".zip", ".bmp", ".cab" and
",inf" with a file that has the original file name, the original
extension and an additional extension ".vbs".
In addition, VBS/LoveLetter.T places an HTML file to the Windows
System directory, "BAND-AID.HTM", that is used to spread the worm via
IRC.
[Analysis: Katrin Tocheva, Mikko Hypponen, Alexey Podrezov and Sami Rautiainen, F-Secure]
