This variant of Email-Worm:VBS/Loveletter is distributed as an infectious e-mail file attachment.
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.
You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.
This variant spreads in a message with the following content:
Subject: fwd: Joke Attachment: Joke.vbs
VBS/LoveLetter.BE@mm is quite similar with the original VBS/LoveLetter.A. This variant saves itself to the Windows System directory as "Jokes.vbs" and "Jokes.htm".
Also this variant uses a different set of extensions, so the files with the following extensions are deleted: ".js", ".zip", ".css", ".doc", ".xls" and ".htm"; and the files with following extensions are hidden: ".mp3" and ".mid". The worm creates a new file using the original file name and a ".vbs" extension for each file that it deletes or hides.
This variant does not spread via mIRC.
Description Details: F-Secure; June 2001
Technical Details:Sami Rautiainen