This worm appears to originate from Manila, Phillipines. It has wide-spread distribution, infecting millions of computers. This worm sends itself to email addresses in the Microsoft Outlook address book and also spreads itself into Internet chatrooms via mIRC. This worm overwrites files on local and remote drives, including files with the extensions
.vbs, .vbe, .js, .jse, .css, .wsh, .sct, .hta, .jpg, .jpeg, .wav, .txt, .gif, .doc, .htm, .html, .xls, .ini, .bat, .com, .mp3, and
.mp2.
VBS.LoveLetter.A |
|
This VBS worm does little but replicate. It attempts to copy itself across a network by first locating shared network drives,
then mapping them to a local drive letter. Once a drive is infected, the worm tries to copy itself to the \Startup folder of the
drive (assuming the infected drive is a Win95/98/NT system drive) to ensure execution at startup. The worm remains in
memory until the system is restarted.
VBS.Network
aka Network.VBS, VBS/Netlog.Worm
|