05/05/2000: UPDATE "Love Letter" Worm

As you may already know, there are numerous reports of a VBScript worm called "Love Letter" in circulation.

Please do not attempt to run the script attached to the message with the following characteristics:

      Subject: ILOVEYOU

The body of the message contains:

      kindly check the attached LOVELETTER coming from me

A file attachment is included, named:

      LOVE-LETTER-FOR-YOU.TXT.vbs

Merely receiving the email will not cause your system to become infected, but running the attachment will. Users should not open e-mails with the subject line ILOVEYOU. and should immediately delete them.

If your computer has already been infected (the e-mail was received and the attachment has been opened), disconnect from the Internet to prevent further propagation. Once opened, the email virus overwrites existing local script and HTML files, as well as picture and music files, with its own code. Specifically, files with extensions .jpg, .jpeg, .mp3, and .mp2 are overwritten.

Anti-virus software vendors are currently working on inoculation software. Once antivirus upgrades are available (McAfee, Symantec, etc.) they will be able to remove the virus but will not be able to restore overwritten files.

UPDATES:

McAfee has an interim EXTRA.DAT file available for download that will provide detection for VBS/LoveLetter.worm.

This interim DAT file is also available from our homepage:

http://www.bol.ucla.edu/EXTRA.DAT

Right click the link and choose Save As. Save the EXTRA.DAT file into the same folder as your SCAN.DAT and CLEAN.DAT files. Most likely, this will be the folder

    \Program Files\Common Files\Network Associates\VirusScan Engine\

Restart your machine. Make sure VirusScan is configured to scan All Files. VirusScan will now be able to detect the "Love Letter" worm.

Norton AntiVirus

Symantec has updated the Norton Antivirus virus definitions and they are available for download at:

If you have questions regarding this worm, contact the BOL Help Desk at (310)825-7452 option 1.