More variants of VBS.LoveLetter.A worm discovered

Issued by Symantec
Johannesburg, 19 May 2000

The following information is provided by the Symantec Anti-virus Research Centre (SARC). For more information, or to speak with a virus expert, please contact: Jako Voges on 083 4455661 Three main variants of VBS.LoveLetter.A, aka 'Love Bug' have been reported.

All have the same functionality as the original worm except where noted otherwise. All are detected as VBS.LoveLetter.Variant except where noted otherwise.

1.VBS.LoveLetter.B Also known as 'Lithuania Variant' Email subject line: "Susitikim shi vakara kavos puodukui..." This translates to "Let's meet this evening for a cup of coffee..." in English.

Body/attachment: Same as original worm.

2.VBS.LoveLetter.C Also known as 'Very Funny' Email subject line: "fwd: Joke"

Attachment: "Very Funny.vbs". Performs the same as the original worm.

3.VBS.LoveLetter.E Email subject line: "Mothers Day Order Confirmation"

Body: "We have proceeded to charge your credit card amount of $326.92 for the mothers day diamond special. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place. Thanks Again and Have a Happy Mothers Day! mothersday@subdimension.com"

Attachment: "mothersday.vbs" Deletes all .INI and .BAT files.

Symantec

Symantec, a world leader in Internet security technology, provides a broad range of content and network security solutions to individuals and companies. The company is a leading provider of anti-virus protection, vulnerability assessment, Internet content and e-mail filtering, and mobile code detection technologies to enterprise customers. Headquartered in Cupertino, Calif., Symantec has worldwide operations in more than 24 countries.