F-Secure Virus Descriptions : LoveLetter.N

NAME:

LoveLetter.N

Information about the original VBS/LoveLetter.A is available at: http://www.F-Secure.com/v-descs/love.shtml

VBS/LoveLetter.N variant spreads in a message with the following content:

    Subject:    LOOK!
    Body:       hehe...check this out.
    Attachment: LOOK.vbs

This variant deletes all files with the extension ".xls" or ".mdb". It also hides all files with the extension ".lnk" or ".exe". After the original file has been deleted or hidden, the worm creates a copy of itself using the original filename and an additional extension ".vbs".

[Analysis: Katrin Tocheva, Mikko Hypponen, Alexey Podrezov and Sami Rautiainen, F-Secure]