T prevent infection. I'm including what information I have about this virus below. Again, please contact ASO as soon as possible if you receive this virus. VBS:LoveLetter Overview VBS:LoveLetter is a computer worm created in VBS (Visual Basic Script language). It arrives via e-mail and is activated by double click on the message attachment called LOVE-LETTER-FOR-YOU.TXT.vbs. It requires Windows Scripting Host to be installed on the victim's computer. This support is not installed under Windows 95 and Windows NT 4 by default. It is installed under Windows 98 and Windows NT and it is also part of some additional software packages (such as Microsoft Internet Explorer v5.x). VBS:LoveLetter was discovered on 4th May 2000 and it spreads like a fire. This worm uses e-mail as the primary spreading channel. It is also able to use mIRC client as secondary distribution channels. VBS:LoveLetter copies itself to following files: MSKernel32.vbs and LOVE-LETTER-FOR-YOU.TXT.vbs in the system directory and Win32DLL.vbs in the Windows directory. It also modifies two registry keys for its activation after computer restart: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MsKernel32 HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32DLL VBS:LoveLetter sends itself via Outlook application as an attachment in a similar way as Melissa does. It sends the infected message to all recipients in every address book. The message has the following subject and body: Subject: ILOVEYOU Body: kindly check the attached LOVELETTER coming from me. The worm sends itself only once from the infected computer. If the file system\WinFAT32.exe does not exist, worm sets the MSIE start page to remote EXE file on certain web page. After successfull download of file named WIN-BUGSFIX.exe it sets another registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX in order to run this file on every computer restart and sets the MSIE start page to about:blank VBS:LoveLetter searches for the certain files on all local and remote drives. If it finds the file with extension vbs or vbe, it overwrites such file with itself. Files with extension js, jse, css, wsh, sct, hta are overwritten as well and renamed to *.vbs. Also jpg and jpeg files are overwritten and renamed to *.jpg.vbs, while mp3 and mp2 files are overwritten, renamed to *.mp?.vbs and their attributes are changed. When VBS:LoveLetter finds mIRC client, it overwites the "mirc.ini" file and is able to send itself to other users via IRC channels. Worm also drops the HTM file in order to get better chance to spread. Removal Delete all infected files and remove all registry keys mentioned above. Then reboot the computer. Any avast! with VPS file dated on or after 4th May 2000 is able to detect this virus. -- Jon Keene Room 22H Love Library Automated Systems Office 402-472-4538 UNL Libraries [log in to unmask] ========================================================= Important Subscriber Information: The Museum-L FAQ file is located at http://www.finalchapter.com/museum-l-faq/ . You may obtain detailed information about the listserv commands by sending a one line e-mail message to [log in to unmask] . The body of the message should read "help" (without the quotes). If you decide to leave Museum-L, please send a one line e-mail message to [log in to unmask] . The body of the message should read "Signoff Museum-L" (without the quotes).