VBS/Loveletter.n Alias: Variant Test
Subject: Variant Test
Body: This is a variant to the vbs virus.
Notes: Copies itself as sndvol32.vbs and IEAKDLL.vbs. Internet Explorer start page changed to http://altalavista.box.sk. It does not download the password stealing trojan. Overwrites *.mpg, *.mpeg, *.avi, *.qt, *.qtm. Sends the file important.htm into Internet chat rooms via mIRC.
VBS/Loveletter.o Alias: Unnamed
Body: kindly check the attached LOVELETTER coming from me.
Notes: Mostly the same as A version
VBS/Loveletter.p Alias: Yeah, Yeah
Subject: Yeah, Yeah another time to DEATH...
Body: This is the Killer for VBS.LOVE-LETTER.WORM.
Notes: Sets the Internet Explorer start page to http://www.yahoo.com/Vir-Killer.exe. It does not download the password stealing trojan. Overwrites *.ZIP and *.RAR files instead of *.JPG and *.JPEG file. Hides *.PAS and *.ASM files instead of *.MP3 and *.MP2
VBS/Loveletter.q Alias: LOOK!
Body: hehe...check this out.
VBS/Loveletter.r Alias: Bewerbung
Subject: Bewerbung Kreolina
Body: Sehr geehrte Damen und Herren!
Notes: Send HTM file to chat rooms
VBS/Loveletter.s Alias: Unnamed
Body: kindly check the attached.
Notes: Same as A except several comment lines have been added.
Variants : a to e Think it's over? Think again. Here are the latest variants to watch for in your email inbox.
Variants : f to i Phoney Symantec warning and 'Important!' virus variants.
Variants : j to m "I Can't Believe This!", Arab Air and other virus variants.
Go to ZDNet's ILOVEYOU Special Report