The Computer Guys

Miami to Fort Lauderdale Since 1994 - Thank You!

We Build the Best & Repair the Rest! ©

Top 10 malware reported to Sophos in June 2000

This section helps you to understand how it behaves

This is a worm which tries to spread itself in several ways. Most commonly, it sends itself as an attachment to an email.

Infected emails have the subject line:

ILOVEYOU

The message text is:

kindly check the attached LOVELETTER coming from me.

The attachment is called LOVE-LETTER-FOR-YOU.TXT.vbs, which has a double-extension. Mailers which suppress well-known extensions such as .vbs may present this file as LOVE-LETTER-FOR-YOU.TXT, which appears more innocent. Because the worm arrives in a VBS file, it requires the Windows Scripting Host (WSH) in order to work. If you disable WSH, the viral attachment will be rendered harmless.

The worm also drops an HTM file which can spread the worm, and a mIRC script which tries to distribute it.

The worm checks the Internet Explorer Download Directory for the presence of the file WinFAT32.exe. If that file does not exist the worm randomly picks one of four websites and changes the registry to set it as the Start Page for Internet Explorer. The websites point to an EXE file, WIN-BUGSFIX.exe, which is then downloaded and the registry is modified to run the file on reboot. This file is detected as Troj/LoveLet-A. The Internet Explore Start Page is also set to blank.

The worm copies itself to two places in the system directory where they are executed each time the computer reboots.

The email component of the worm requires Microsoft Outlook to work. If you are using Outlook it will try to send itself to each entry in your Windows Address Book.

The worm also searches all local and networked drives for files that end with the extensions VBS, VBE, JS, JSE, CSS, WSH, SCT or HTA. These files are overwritten with the worm and their extension is renamed to .VBS.

Any JPG or JPEG files are also overwritten by the worm but have the extension .VBS added to the existing filename.

Any MP2 or MP3 files are overwritten by the worm but are also copied to a new file that has the .VBS extension added. The original files are set as hidden.

If the worm determines that mIRC is installed on the system it will drop a mIRC script that will send the worm on via mIRC.

Enter your search terms Submit search form   Web www.cpucare.com

This webpage is optimized for 800 x 600 monitor resolution or above and the latest web browser.