von Computer Associates (
http://www.ca.com/virusinfo/encyclopedia/ ) gibt dazu folgendes zu vermelden:
-----
VBS.ILoveYou.BE worm (also known as VBS.LoveLetter.BE)
This variant of the worm is functionally the same as VBS.ILoveYou.A The differences lie within the e-mail subject, the body text content, and the name of the file containing the worm.
This worm spreads by attaching itself to an outbound e-mail sent to all addresses found in the Microsoft Outlook Address Book. It does not impose a limit on the number of recipients, so it will send itself to every e-mail address it finds.
Files dropped by this variant are:
MSKernel32.vbs
Win32DLL.vbs
VIVE-LA-VIDA-LOCA.vbs
The files that are overwritten have the following extensions: VBS, VBE, JS, JSE, CSS, WSH, SCT, HTA, JPG, JPEG, MP3 and MP2 (MP3 and MP2 files are hidden). The e-mail messages it sends will always have a subject:
"Ya no más PRI"
and the body of the e-mail contains the message:
"Si usted es listo ya no vote por el PRI, vote por mí. Cuatemochas 2000."
There is an attached file named "VIVE-LA-VIDA-LOCA.vbs".
-----
und zur Urversion .A mit Anleitung zur Virusentfernung und Systeminstandsetzung:
-----
VBS.ILoveYou.A worm (also known as VBS.LoveLetter.A, VBS/LoveLet-A and The Love Bug)
VBS.ILoveYou.A is a new VBS based worm that has recently begun spreading rapidly via e-mail. It can cause mail servers to become overloaded by a huge volume of infected e-mail. It is written in Microsoft's Visual Basic Script language.
It spreads by attaching itself to an outbound e-mail sent to all addresses found in the Microsoft Outlook Address Book. It does not impose a limit on the number of recipients, so it will send itself to every e-mail address it finds. The e-mail messages it sends always have a subject of ILOVEYOU. The body contains a message: kindly check the attached LOVELETTER coming from me. There is an attachment called LOVE-LETTER-FOR-YOU.TXT.vbs. The attachment is the worm itself, which will activate if the recipient opens the attachment. This worm will operate on any system that has Windows Scripting Host (WSH) installed (this is the default for Windows 98 and Windows 2000). Many Windows 95 and NT 4 systems will also have WSH installed (it is part of Internet Explorer 4 and above), although this may not be known to the user. If you have any of the above systems, you should assume that you are vulnerable to this virus.
The worm will install itself on a machine by coping itself to multiple subdirectories under the different names:
In the Windows directory under the name Win32DLL.vbs.
In the Windows system directory under the name MSKernel32.vbs.
In the Windows system directory under the name LOVE-LETTER-FOR-YOU.TXT.vbs.
The worm modifies registry information to make itself run during the next boot up.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ MSKernel32=C:\WINDOWS\SYSTEM\MSKernel32.vbs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ RunServices\Win32DLL=C:\WINDOWS\Win32DLL.vbs
It also sets the default page of Internet Explorer to download a copy of a file called WIN_BUGSFIX.exe. The web pages it refers to are currently not operational. The virus can also use the mIRC program to distribute itself via IRC channels. If it detects the presence of mIRC, it will try to send an HTML file containing itself to other IRC users. Below is a screenshot of what you see when you open the .HTM form of the VBS.ILoveYou.A worm. This is the file that is sent via the mIRC script to IRC channels.
http://www.ca.com/virusinfo/encyclopedia/...tions/shots/iloveyoua.gifAs a payload, the worm will recurse through all the subdirectories of all local and shared drives found on the computer and will overwrite the files with the following extensions: VBS, VBE, JS, JSE, CSS, WSH, SCT, HTA, JPG, JPEG, MP3, and MP2. The overwritten files will contain the worm's body and the extensions will be changed to vbs. Every time an affected file is opened, the worm will be activated. For example, a file called Satisfaction.MP3 would become Satisfaction.MP3.VBS. Files with MP2 and MP3 extensions are hidden after the MP2.VBS and MP3.VBS files are created and can be recovered by an experienced user.
To remove the virus:
Delete all infected messages from your e-mail client
Remove the registry key. To remove the registry key automatically, click here to download an INF file. Save the file to your desktop, right-click on the file and choose "Install" to run it. This file will remove the keys that the virus has added to the registry.
Reboot your computer for these changes to take effect.
To restore MP2 and MP3 files using Windows 95, 98 and NT:
Open Windows Explorer.
Select View | Options and then click on the View tab.
Under the section named Hidden files, click the radio button beside "Show all files"
Click on Apply for these changes to take effect, then OK to close the window.
Next, locate the directory where the MP2 and MP3 files are stored.
Select all of the affected files (scroll over to the attributes column and if you see an H there, the file has been hidden).
Position the mouse cursor somewhere over the selection and then click the right mouse button and select Properties from the menu.
Under the General tab, un-check the "Hidden" box.
Click on Apply for the changes to take affect.
To restore MP2 and MP3 files using MS-DOS or Command Prompt:
At the C:\> prompt, type CD directory (where directory is the location of the MP2 and MP3 files.
At the next C:\> prompt, type attrib -h filename (eg attrib -h satisfaction.mp3) to change the attributes of one file at a time, or attrib -h *.mp2 (or .mp3) to change the attributes of all files simultaneously.
-----
Hoffentlich wurde der nicht auch noch über E-Mail weiterverbreitet ...
Grüße, r.
