Virus Updates and link to software to clean it off if infected ...

[Guest guest]

I will try to send these out to you as I get them folks in order to

prevent more bad days like many of you had last week...THIS IS NOT A

HOAX! This is real...Turn on your televisions if you need " proof " !

If you have been infected, try this link:

QFLEA.com has set up a special page to provide information as well as a

link to anti-virus software for those interested. In the wake of the

latest virus to emerge, I hope that this link is helpful to you.

http://www.qflea.com/special.htm

Have a safe, virus-free day!

About the viruses:

These new viruses have been altered and can destroy system files, word,

excel and many other file types includingimages. Do not open any

attachment that has .vbs as part of the file name.

The recent virus updates that we sent out will protect against this

virus,

but as always, never open an attachment from an unknown source.

Please read the following information regarding these new viruses, the

subjects are varied and some may seem legitimate but they will have an

attachment that is the virus. There are currently 13 new variants of the

Love Letter virus that have been identified. There are descriptions of

these taken from Symantec's web site below.

" Symantec has identified 13 versions of VBS.LoveLetter. This information

is current as of May 7, 2000.

1.VBS.LoveLetter.A

Norton AntiVirus detects as:

VBS.LoveLetter.A(1)

ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs

SUBJECT LINE: ILOVEYOU

MESSAGE BODY: kindly check the attached

LOVELETTER coming from me.

2.VBS.LoveLetter.B (also known as Lithuania)

Norton AntiVirus detects as:

VBS.LoveLetter.B(1)

ATTACHMENT: same as A

SUBJECT LINE: Susitikim shi vakara kavos

puodukui...

MESSAGE BODY: same as A

3.VBS.LoveLetter.C (also known as Very Funny)

Norton AntiVirus detects as:

VBS.LoveLetter.C(1)

ATTACHMENT: Very Funny.vbs

SUBJECT LINE: fwd: Joke

MESSAGE BODY: empty

4.VBS.LoveLetter.D (also known as BugFix)

Norton AntiVirus detects as:

VBS.LoveLetter.A(1)

ATTACHMENT: same as A

SUBJECT LINE: same as A

MESSAGE BODY: same as A

MISC. NOTES: registry entry: WIN- -BUGSFIX.exe

instead

of WIN-BUGSFIX.exe

5.VBS.LoveLetter.E (also known as Mother's Day)

Norton AntiVirus detects as:

VBS.LoveLetter.Variant.E

ATTACHMENT: mothersday.vbs

SUBJECT LINE: Mothers Day Order Confirmation

MESSAGE BODY: We have proceeded to charge your

credit card for the amount of $326.92 for the

mothers day

diamond special. We have attached a detailed

invoice to

this email. Please print out the attachment

and

keep it in a

safe place.Thanks Again and Have a Happy

Mothers

Day!

mothersday@...

MISC. NOTES: mothersday.HTM sent in IRC, &

comment:

rem hackers.com, & start up page to

hackes.com,

l0pht.com, or 2600.com

6.VBS.LoveLetter.F (also known as Virus Warning)

Norton AntiVirus detects as:

VBS.LoveLetter.Variant.F

ATTACHMENT: virus_warning.jpg.vbs

SUBJECT LINE: Dangerous Virus Warning

MESSAGE BODY: There is a dangerous virus

circulating.

Please click attached picture to view it and

learn

to avoid

it.

MISC. NOTES: Urgent_virus_warning.htm

7.VBS.LoveLetter.G (also known as Virus ALERT!!!)

Norton AntiVirus detects as:

VBS.LoveLetter.Variant or

VBS.LoveLetter.G

ATTACHMENT: protect.vbs

SUBJECT LINE: Virus ALERT!!!

MESSAGE BODY: a long message regarding

VBS.LoveLetter.A

MISC. NOTES: FROM support@.... This

variant also overwrites files with .bat and

..com

extensions.

8.VBS.LoveLetter.H (also known as No Comments)

Norton AntiVirus detects as: VBS.LoveLetter.A

ATTACHMENT: same as A

SUBJECT LINE: same as A

MESSAGE BODY: same a A

MISC. NOTES: the comment lines at the

beginning of

the

worm code have been removed.

9.VBS.LoveLetter.I (also known as Important! Read

carefully!!)

Norton AntiVirus detects as:

VBS.LoveLetter.Variant

ATTACHMENT: Important.TXT.vbs

SUBJECT LINE: Important! Read carefully!!

MESSAGE BODY: Check the attached IMPORTANT

coming from me!

MISC. NOTES: new comment line at the

beginning:

by:

BrainStorm / @ElectronicSouls. It also copies

the

files

ESKernel32.vbs & ES32DLL.vbs, and MIRC script

comments referring to BrainStorm and

ElectronicSouls and

sends IMPORTANT.HTM to the chat room.

10.VBS.LoveLetter.J

Norton AntiVirus detects as:

VBS.LoveLetter.Variant

ATTACHMENT: protect.vbs

SUBJECT LINE: Virus ALERT!!!

MESSAGE BODY: Largely the same as the G

variant.

MISC. NOTES: This appears to be a slight

modification of

the G variant.

11.VBS.LoveLetter.K

Norton AntiVirus detects as:

VBS.LoveLetter.Variant

ATTACHMENT: Virus-Protection-Instructions.vbs

SUBJECT LINE: How to protect yourself from the

IL0VEY0U bug!

MESSAGE BODY: Here's the easy way to fix the

love

virus.

MISC. NOTES:

12.VBS.LoveLetter.L (I Cant Believe This!!!)

Norton AntiVirus detects as:

VBS.LoveLetter.Variant

ATTACHMENT: KillEmAll.TXT.VBS

SUBJECT LINE: I Cant Believe This!!!

MESSAGE BODY: I Cant Believe I have Just

Recieved

This

Hate Email .. Take A Look!

MISC. NOTES: comment has phrase/words: Killer,

by

MePhiston, replaces GIF & BMP instead of JPG &

JPEG,

hides WAV & MID instead of MP3 & MP2. NO IRC

routine,

there it will not infect chat room users.

Copies

KILER.HTM, KILLER2.VBS, KILLER1.VBS to the

hard

disk.

13.VBS.LoveLetter.M (Arab Air)

Norton AntiVirus detects as:

VBS.LoveLetter.Variant

ATTACHMENT: ArabAir.TXT.vbs

SUBJECT LINE: Thank You For Flying With Arab

Airlines

MESSAGE BODY: Please check if the bill is

correct,

by

opening the attached file

MISC. NOTES: Replaces DLL & EXE files instead

of

JPG

& JPEG. Hides SYS & DLL files instead of MP3 &

MP2.

Copies no-hate-FOR-YOU.HTM to the hard disk.

Also known as: Lovebug, I-Worm.LoveLetter,

VBS/LoveLetter.A,

VBS/LoveLet-A "