Information About the VBS.LOVELETTER Worm Virus (282832)


The information in this article applies to:

  • Microsoft Internet Explorer 5.5 for Windows Millennium Edition SP 1
  • Microsoft Internet Explorer 5.5 for Windows 98 Second Edition SP 1
  • Microsoft Internet Explorer 5.01 for Windows 98 Second Edition SP 1
  • Microsoft Internet Explorer 5.5 for Windows 98 SP 1
  • Microsoft Internet Explorer 5.01 for Windows 98 SP 1
  • Microsoft Internet Explorer 5.0 for Windows 98
  • Microsoft Internet Explorer 4.01 for Windows 98 SP 2
  • Microsoft Internet Explorer 5.5 for Windows 95 SP 1
  • Microsoft Internet Explorer 5.01 for Windows 95 SP 1
  • Microsoft Internet Explorer 5.0 for Windows 95
  • Microsoft Internet Explorer 4.01 for Windows 95 SP 1
  • Microsoft Internet Explorer 4.01 for Windows 95 SP 2
  • Microsoft Internet Explorer 4.0 for Windows 95
  • Microsoft Internet Explorer 3.02 for Windows 95
  • Microsoft Internet Explorer 3.01 for Windows 95
  • Microsoft Internet Explorer 3.0 for Windows 95
  • Microsoft Internet Explorer 2.0 for Windows 95
  • Microsoft Internet Explorer version 6 for Windows XP
  • Microsoft Internet Explorer version 6 for Windows 2000
  • Microsoft Internet Explorer version 6 for Windows NT 4.0
  • Microsoft Internet Explorer version 6 for Windows Millennium Edition
  • Microsoft Internet Explorer version 6 for Windows 98 Second Edition
  • Microsoft Internet Explorer version 6 for Windows 98
  • Microsoft Windows NT 4.0
  • Microsoft Windows Millennium Edition
  • Microsoft Windows 95
  • Microsoft Windows 98
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Professional
This article was previously published under Q282832

SYMPTOMS

After you receive an e-mail message with an "'ILOVEYOU' Message 'kindly check the attached LOVELETTER coming from me'" subject and a LOVE-LETTER-FOR-YOU.TXT.vbs attachment, you may experience the following behaviors on your computer:
  • Files with the following file name extensions may be replaced with the same file name but with an added .vbs file name extension, or the files may be hidden and copies of the files may be created with an added .vbs file name extension:

    .bat
    .com
    .css
    .doc
    .gif
    .hta
    .htm
    .html
    .ini
    .jpg
    .jpeg
    .js
    .jse
    .mp2
    .mp3
    .sct
    .txt
    .vbe
    .vbs
    .wav
    .wsh
    .xls

    Note If you are running Microsoft Windows 2000 or Windows XP, you may receive the following message repeatedly as these files are replaced:

    Windows File Protection Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files.

  • The LOVE-LETTER-FOR-YOU.HTM file may be on your computer. If you have installed an Internet Chat Relay client on your computer, the Script.ini file for that client may also be replaced.
  • When you send mail to recipients in your Microsoft Outlook address book, the LOVE-LETTER-FOR-YOU.TXT.VBS file may be automatically sent with the message.
  • The Win-bugsfix.exe file may be on your computer.
  • Your default home page in Internet Explorer may have changed.

CAUSE

This behavior may occur if your computer is infected with the VBS.LOVELETTER worm virus or with a variation of that virus.

MORE INFORMATION

Microsoft does not offer software for virus detection or removal. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software from a vendor that is commercially involved in virus detection and removal. For additional information about third-party antivirus software and vendors, click the following article number to view the article in the Microsoft Knowledge Base:

49500 List of Antivirus Software Vendors

Recommended Updates

Scriptlet.typelib or Eyedog vulnerability:

http://www.microsoft.com/technet/security/bulletin/ms99-032.mspx

Malformed e-mail header vulnerability:

http://www.microsoft.com/technet/security/bulletin/MS00-043.mspx

Outlook e-mail security updates:

http://office.microsoft.com

Modification Type:MinorLast Reviewed:7/8/2005
Keywords:kbdownload kbdownload kbprb kbvirus KB282832
©2004 Microsoft Corporation. All rights reserved.