Hi !  OK I am telling you all the time that a virus IS a hoax when people
send hoax viruses alerts to me, well this one is NOT a hoax.......  see
below for partial details and see here for full details:
http://www.drsolomon.com/home/vbslove.htm

Virus Name:      VBS/LoveLetter.worm

Aliases:            none known

 Characteristics:

This worm is a VBS program that is sent attached to an email with the
subject ILOVEYOU.

The mail contains the message "kindly check the attached LOVELETTER coming
from me."

 The attachment is called LOVE-LETTER-FOR-YOU.TXT.vbs

 If the user runs the attachment the worm runs using the Windows Scripting
Host program. This is not normally present on

Windows 95 or Windows NT unless Internet Explorer 5 is installed.



After a short delay the worm uses Microsoft Outlook to send copies of itself
to all entries in the address book.

The mails will be of the same format as the original mail.

 This worm also has another trick up it's sleeve in that it tries to
download and install an executable file called WIN-BUGSFIX.EXE from the
Internet. This exe file is a password stealing program that will email any
cached passwords to the mail address [log in to unmask]

 In order to facilitate this download the worm sets the start-up page of
Microsoft Internet Explorer to point to the web-page containing the password
stealing trojan.



Date Discovered: Thursday May 4th 2000

DAT included:    4077

Risk:                 High



互户互户互户互户互户互

Cindy Curtis,RN,IBCLC
mailto:[log in to unmask]
http://www.erols.com/cindyrn

             ***********************************************
The LACTNET mailing list is powered by L-Soft's renowned
LISTSERV(R) list management software together with L-Soft's LSMTP(TM)
mailer for lightning fast mail delivery. For more information, go to:
http://www.lsoft.com/LISTSERV-powered.html