The Computer Guys

Miami to Fort Lauderdale Since 1994 - Thank You!

We Build the Best & Repair the Rest! ©

Top 10 malware reported to Sophos in October 2000

This section helps you to understand how it behaves

VBS/LoveLet-AS is a Visual Basic Script worm.

The worm forwards itself as an email attachment with the subject line:

'US PRESIDENT AND FBI SECRETS =PLEASE VISIT => (http://WWW.2600.COM)<='

or a random 6 letter string.

The message body will either be

'VERY JOKE..! SEE PRESIDENT AND FBI TOP SECRET PICTURE..'

or a random 10 letter string.

Running the attached file infects your computer.

On the 17 September the worm displays a message box containing the text

"Dedicated to my best brother=>Christiam Julian(C.J.G.S.) Att. TEGIF (M.H.M. Team)"

where 'TEGIF' can be any random 5 letters.

It then attempts to disconnect drives Z: through to E:.

The worm attempts to download the files MACROMEDIA32.ZIP, LINUX321.ZIP and LINUX322.ZIP via Internet Explorer. Despite their filenames these files are not true ZIP files but rather a text file and two bitmap graphic files.

MACROMEDIA32.ZIP is copied to the Windows directory with the filename important_note.txt and set to run on startup with the registry entry HKLM\Software\Microsoft\Windows\CurrentVersion\Run.

The two other files are copied to the Windows directory as logos.sys and logow.sys respectively.

The worm makes copies of itself (using the filenames LINUX32.VBS and reload.vbs) and sets them to run at startup.

It creates a copy of itself in the System directory with a filename of 5 to 8 characters with either the extension .GIF.VBS or .JPG.VBS - it is this file which is mailed out to all addresses in your Outlook address book.

Enter your search terms Submit search form   Web www.cpucare.com

This webpage is optimized for 800 x 600 monitor resolution or above and the latest web browser.