Date: Fri, 5 May 2000 14:44:07 -0400 (EDT) From: BCPL.NET SysAdmin To: BCPL.NET News Subject: BCPL.NET NEWS: More LoveLetter Virus Varients Reported --------------------------------------- MORE LOVELETTER VIRUS VARIANTS REPORTED --------------------------------------- There are now at least five variants of the "ILOVEYOU" virus that we described in BCPL.NET News yesterday and earlier today. They are now being described collectively as the "LoveLetter" virus. All variants work the same way, but there are differences in the wording of the e-mail messages used to distribute them. Below are brief descriptions of all variants known at the time of this message, but there may well be more by the time this reaches you. LoveLetter.A ------------ The original version, distributed via e-mail with the following characteristics: Subject: ILOVEYOU Body: kindly check the attached LOVELETTER coming from me. Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs LoveLetter.B ------------ In this variant the Subject line of the e-mail is in Lithuanian, and supposedly means "Let's meet this evening for a cup of coffee..." Subject: Susitikim shi vakara kavos puodukui... Body: kindly check the attached LOVELETTER coming from me. Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs LoveLetter.C ------------ This variant propagates in e-mail with the following characteristics: Subject: fwd: Joke Attachment: Very Funny.vbs LoveLetter.D ------------ The e-mail that carries this variant has the same characteristics as LoveLetter.A. It is believed the executable file attachment (LOVE-LETTER-FOR-YOU.TXT.vbs) has been modified to better evade virus detection software. LoveLetter.E ------------ This variant is distributed in e-mail with the following characteristics: Subject: Mothers Day Order Confirmation Body: We have proceeded to charge your credit card for the amount of $326.92 for the mothers day diamond special. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place.Thanks Again and Have a Happy Mothers Day! mothersday@subdimension.com Attachment: mothersday.vbs Virus control experts predict that there could be many more LoveLetter variants before this is over. Unless something extraordinary happens this will be the last BCPL.NET News message about LoveLetter, because the information is readily available on the Internet. I recommend the F-Secure (formerly DataFellows) Web site for up-to-date information on all known computer viruses and virus hoaxes: http://www.F-Secure.com/ For information specifically on the LoveLetter virus, see: http://www.F-Secure.com/v-descs/love.htm http://www.F-Secure.com/news/2000/news_2000050500.html Your best protection against any e-mail transmitted virus is plain old common sense. If you receive a message with a file attachment from someone you don't know, or from someone you do know but from whom you weren't expecting an attachment, don't save the attachment to your hard drive. If you do save it, don't open it. During the current LoveLetter crisis it may be a good idea not to open any attachment unless the sender is known to you, the attachment was really intended for you, and the sender verifies that it is safe. LoveLetter spreads itself by sending e-mail to everyone in any Outlook address book it finds on the infected computer. Your friends could be sending it to you without knowing it. By the way, LoveLetter affects only Windows computers, so Macintosh and UNIX users needn't worry about infection. However if you Mac and UNIX users receive e-mail matching the characteristics described above, delete it. Don't send it to anyone else. -- BCPL.NET INTERNET SERVICES CONTACTS: ----------------------------------- Web Site: http://www.bcpl.net Administration & Policy: ispadmin@bcpl.net 410-887-6180 Sales, Renewals, Account Status: accounts@bcpl.net 410-887-4172 Technical Support (Help Desk): help@bcpl.net 410-887-3297 Usenet News Newsgroup Requests news-admin@bcpl.net 410-887-6180 E-Mail & Newsgroup Abuse Reports: abuse@bcpl.net 410-887-6180 FAX: 410-887-2091