🚀 go-pugleaf

Given the importance of the topic I'll post here information from the
F-PROT Web site (www.complex.is). The following is a page from the 
site converted to plain text. I am simply copying it, and claim no 
credit for this information:

(copied by) Michael Salem

The VBS/LoveLetter.A Worm

The worm is received either as an e-mail attachment or via IRC.

If it is received via e-mail, the Subject: of the message is "ILOVEYOU" and
the body of the message says

kindly check the attached LOVELETTER coming from me.

The name of the attachment is LOVE-LETTER-FOR-YOU.TXT.vbs (which, if the
system is configured not to show the extensions of the files, will look
like a TXT file to the user).

If it is received via IRC, it resides in a file named
LOVE-LETTER-FOR-YOU.HTM. When executed, the worm makes copies of itself
under the names MSKernel32.vbs and LOVE-LETTER-FOR-YOU.TXT.vbs in the
Windows System directory and under the name Win32DLL.vbs in the Windows
directory. Then it modifies the Registry, so that the files Win32DLL.vbs
and MSKernel32.vbs will be executed every time Windows is started.

Then the worm modifies the Registry, changing the startup page of the
Internet Explorer, so that when IE is started, it will download a file
named WIN-BUGSFIX.exe from one of 4 possible places on
http://www.skyinet.net/ (randomly selected) and the Registry is modified,
so that this file is executed the next time Windows is started.

Then the worm creates an HTML version of itself, in a file named
LOVE-LETTER-FOR-YOU.HTM in the Windows System directory.

Next, the worm starts a copy of Outlook in the background (only Outlook 98
or 2000 will work - not Outlook 97 or Outlook Express). It examines all
Outlook Address Books and, if an Outlook Address Book contains more
addresses than the Windows Address Book, the worm mass-mails itself to all
addresses in that Outlook Address Book. (The worm does not mass-mail itself
to any addresses in the Windows Address Book.)

Finally, the virus examines all directories on all hard and network drives.
If a file has one of the ollowing extensions: VBS, VBE, JS, JSE, CSS, WSH,
SCT, HTA, JPG or JPEG the virus overwrites the file with a copy of itself.
If the extension was not VBS or VBE, the virus adds the extension VBS to
the name of the file - so that, for instance, PICTURE.JPG becomes
PICTURE.JPG.vbs. If a file with the extension MP2 or MP3 is found, the
virus sets its file attribute to Hidden and copies itself in the same
directory in a file with the same name but with ".vbs" appended to it. For
instance, if a file named SONG.MP3 is found, its file attribute will be set
to Hidden and the virus will copy itself to a file named SONG.MP3.vbs in
the same directory where that file resides.

If, during this directory traversal, any of the following files is found:
mirc32.exe, mlink32.exe, mirc.ini, script.ini or mirc.hlp, the worm drops
in that directory a file named SCRIPT.INI which begins with the comments

;mIRC Script
; Please dont edit this script... mIRC will corrupt, if mIRC
will
 corrupt... WINDOWS will affect and will not run correctly.
thanks
;
;Khaled Mardam-Bey
;http://www.mirc.com
This mIRC script tries to send the file LOVE-LETTER-FOR-YOU.HTM from the
Windows System directory via IRC's command /DCC to all users joining the
IRC channel which the infected user is on.

The worm sets or modifies the following Registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting
Host\Settings\Timeout
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi
n32DLL

The file WIN-BUGSFIX.exe is a Backdoor created in the Phillippines which
collects the network passwords cached by Windows and sends them to an
attacker's site (MAILME@SUPER.NET.PH) when the infected user connects to
the Internet.

The users at risk are those who have the Windows Scripting Host installed
on their machines. In practice, this means:

	Users of Windows 98.
	Users who have installed Internet Explorer 5.x in default
           installation mode, regardless of which version of Windows they
           are using.

	Users who have explicitly downloaded and installed WSH from
           Microsoft's Web site.

The virus cannot spread via e-mail from an infected machine which does not
have Outlook 98 or Outlook 2000 installed. However, these versions of
Outlook are not necessary to be present, in order for the virus to infect
the machine (i.e., come to it) - infection can occur through Outlook
Express, for instance, and possibly through other e-mail clients. Also,
even if Outlook 98 or 2000 are not installed on the target machine, the
virus can still infect it via IRC or remotely mapped network drives.

In order to remove the virus, we commend the following procedure:
	Download the latest version of F-PROT from here;
	Unpack the archive to a folder where you want the product to be reside;
	Download the latest virus definition database from here and unpack them to the same folder
           where you have installed F-PROT;
	Exit to DOS. If the virus has succeeded to start the file
           WIN-BUGSFIX.exe, it won't be possible to delete this file while
           Windows is running;
	Run F-PROT and instruct it to scan all files (regardless of their
           extension) and to delete automatically the infected files it
           finds:
f-prot /hard /disinf /auto /dumb
	Start Windows. You might get a couple of error messages that some
           programs could not be started - this is normal;
	Start the Registry Editor and delete the keys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKe
rnel32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServi
ces\Win32DLL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-
BUGSFIX
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WinF
AT32=WinFAT32.EXE
(Some of these might not be present.)

Done. You might also want to search (via Find/Files or Folders from the
Start menu) for any *.mp2 and *.mp3 files and turn off their Hidden
attribute.

Analysis by: Dr. Vesselin Bontchev