Microsoft KB Archive/282832

= Information About the VBS.LOVELETTER Worm Virus =

Article ID: 282832

Article Last Modified on 1/29/2007

-

APPLIES TO


 * Microsoft Internet Explorer 5.5 Service Pack 1
 * Microsoft Internet Explorer 5.5 Service Pack 1
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.5 Service Pack 1
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.0
 * Microsoft Internet Explorer 4.01 Service Pack 2
 * Microsoft Internet Explorer 5.5
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.0
 * Microsoft Internet Explorer 4.01 Service Pack 1
 * Microsoft Internet Explorer 4.01 Service Pack 2
 * Microsoft Internet Explorer 4.0 128-Bit Edition
 * Microsoft Internet Explorer 3.02
 * Microsoft Internet Explorer 3.01
 * Microsoft Internet Explorer 3.0
 * Microsoft Internet Explorer 2.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Windows NT 4.0
 * Microsoft Windows Millennium Edition
 * Microsoft Windows 95
 * Microsoft Windows 98 Standard Edition
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional

-



This article was previously published under Q282832



SYMPTOMS
After you receive an e-mail message with an &quot;'ILOVEYOU' Message 'kindly check the attached LOVELETTER coming from me'&quot; subject and a LOVE-LETTER-FOR-YOU.TXT.vbs attachment, you may experience the following behaviors on your computer:  Files with the following file name extensions may be replaced with the same file name but with an added .vbs file name extension, or the files may be hidden and copies of the files may be created with an added .vbs file name extension:

.bat

.com

.css

.doc

.gif

.hta

.htm

.html

.ini

.jpg

.jpeg

.js

.jse

.mp2

.mp3

.sct

.txt

.vbe

.vbs

.wav

.wsh

.xls

Note If you are running Microsoft Windows 2000 or Windows XP, you may receive the following message repeatedly as these files are replaced:

Windows File Protection Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files.

 The LOVE-LETTER-FOR-YOU.HTM file may be on your computer. If you have installed an Internet Chat Relay client on your computer, the Script.ini file for that client may also be replaced. When you send mail to recipients in your Microsoft Outlook address book, the LOVE-LETTER-FOR-YOU.TXT.VBS file may be automatically sent with the message. The Win-bugsfix.exe file may be on your computer. Your default home page in Internet Explorer may have changed.



CAUSE
This behavior may occur if your computer is infected with the VBS.LOVELETTER worm virus or with a variation of that virus.



MORE INFORMATION
Microsoft does not offer software for virus detection or removal. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software from a vendor that is commercially involved in virus detection and removal. For additional information about third-party antivirus software and vendors, click the following article number to view the article in the Microsoft Knowledge Base:

49500 List of Antivirus Software Vendors

Recommended Updates
Scriptlet.typelib or Eyedog vulnerability:

http://www.microsoft.com/technet/security/bulletin/ms99-032.mspx

Malformed e-mail header vulnerability:

http://www.microsoft.com/technet/security/bulletin/MS00-043.mspx

Outlook e-mail security updates:

http://office.microsoft.com

Additional query words: av lovebug i worm loveletter vbs a lovelet love letter for you txt mskernel32.vbs

Keywords: kbdownload kbvirus kbprb KB282832

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.