News Release

Symantec Discovers New Computer Worm Infecting Thousands

Corporations Worldwide Infected by VBS.LoveLetter.A

CUPERTINO, Calif. - May 4, 2000

What: Researchers at the Symantec AntiVirus Research Center have discovered VBS.LoveLetter.A, an extremely fast-spreading computer worm that uses mIRC and Microsoft Outlook to e-mail itself as an attachment.

Characteriscs of infection: VBS.LoveLetter.A is an Internet worm that uses Microsoft Outlook to spread itself as an attachment with the subject line "ILOVEYOU" along with an attachment called "LOVE-LETTER-FOR-YOU.TXT.vbs."

Payload: Preliminary finding indicate that the worm sends itself to all addresses in the computer user's Outlook address book causing mail servers to clog.

The worm will infect files with the following extensions: vbs, vbe, je, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2.

Additionally, it will delete the following files:

MSKernel32.vbs in the Windows system directory Win32DLL.vbs in the Windows directory LOVE-LETTER-FOR-YOU.TXT.vbs in the Windows System directory WinFAT32.EXE in the Internet download directory WIN-BUGSFIX.EXE in the Internet download directory Script.ini in the mIRC directory

Recommendations/Protection: SARC recommends administrators filter for the attachment name and subject line immediately.