Symantec has identified nine variants of VBS.LoveLetter.A. This
information is current as of May 6, 2000 at 7:30am (PST)
1.VBS.LoveLetter.A
Norton AntiVirus detects as: VBS.LoveLetter.A(1)
ATTACHMENT: LOVE-LETTER-FOR-YOU.TXT.vbs
SUBJECT LINE:
ILOVEYOU
MESSAGE BODY: kindly check the attached
LOVELETTER coming from me.
2.VBS.LoveLetter.B (also known as Lithuania)
Norton AntiVirus detects as: VBS.LoveLetter.B(1)
ATTACHMENT: same as A
SUBJECT LINE:
Susitikim shi vakara kavos puodukui...
MESSAGE BODY: same as A
3.VBS.LoveLetter.C (also known as Very Funny)
Norton AntiVirus detects as: VBS.LoveLetter.C(1)
ATTACHMENT: Very Funny.vbs
SUBJECT LINE:
fwd: Joke
MESSAGE BODY: empty
4.VBS.LoveLetter.D (also known as BugFix)
Norton AntiVirus detects as: VBS.LoveLetter.A(1)
ATTACHMENT: same as A
SUBJECT LINE: same as A
MESSAGE BODY: same as A
MISC. NOTES: registry entry: WIN- -BUGSFIX.exe instead
of WIN-BUGSFIX.exe
5.VBS.LoveLetter.E (also known as Mother's Day)
Norton AntiVirus detects as: VBS.LoveLetter.Variant.E
ATTACHMENT:mothersday.vbs
SUBJECT LINE:
Mothers Day Order Confirmation
MESSAGE BODY: We have proceeded to charge your
credit card for the amount of $326.92 for the mothers day
diamond special. We have attached a detailed invoice to
this email. Please print out the attachment and keep it in a
safe place.Thanks Again and Have a Happy Mothers Day!
[email protected]
MISC. NOTES: mothersday.HTM sent in IRC, & comment:
rem hackers.com, & start up page to hackes.com,
l0pht.com, or 2600.com
6.VBS.LoveLetter.F (also known as Virus Warning)
Norton AntiVirus detects as: VBS.LoveLetter.Variant.F
ATTACHMENT: virus_warning.jpg.vbs
SUBJECT LINE:
Dangerous Virus Warning
MESSAGE BODY: There is a dangerous virus circulating.
Please click attached picture to view it and learn to avoid
it.
MISC. NOTES: Urgent_virus_warning.htm
7.VBS.LoveLetter.G (also known as Virus ALERT!!!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant or
VBS.LoveLetter.G
ATTACHMENT: protect.vbs
SUBJECT LINE:
Virus ALERT!!!
MESSAGE BODY: a long message regarding
VBS.LoveLetter.A
MISC. NOTES: FROM
[email protected]. This
variant also overwrites files with .bat and .com extensions.
8.VBS.LoveLetter.H (also known as No Comments)
Norton AntiVirus detects as: VBS.LoveLetter.A
ATTACHMENT: same as A
SUBJECT LINE: same as A
MESSAGE BODY: same a A
MISC. NOTES: the comment lines at the beginning of the
worm code have been removed.
9.VBS.LoveLetter.I (also known as Important! Read
carefully!!)
Norton AntiVirus detects as: VBS.LoveLetter.Variant
ATTACHMENT: Important.TXT.vbs
SUBJECT LINE:
Important! Read carefully!!
MESSAGE BODY: Check the attached IMPORTANT
coming from me!
MISC. NOTES: new comment line at the beginning: by:
BrainStorm / @ElectronicSouls. It also copies the files
ESKernel32.vbs & ES32DLL.vbs, and MIRC script
comments referring to BrainStorm and ElectronicSouls and
sends IMPORTANT.HTM to the chat room.
Also known as:
Lovebug, I-Worm.LoveLetter, VBS/LoveLetter.A,
VBS/LoveLet-A
Category: Worm