exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

LoveLetterAnalysis.txt

LoveLetterAnalysis.txt
Posted May 5, 2000
Authored by Lamagra | Site lamagra.seKure.de

An overview and Analysis of the LOVE-LETTER-FOR-YOU virus/worm.

tags | paper, worm, virus
SHA-256 | 91e72ac403333b1d6fa854a57c316306f67a39f3f33d59b7d9fe29d968376dcd

LoveLetterAnalysis.txt

Change Mirror Download
      Analysis of the LOVE-LETTER-FOR-YOU virus/worm
------------------------------------------------------------------------------------------------

The virus/worm hit Belgium and the rest of the world on Thursday 15/04/2000. A lot of important
companies were struck including banks, factories and my dads work :).That's where I got the
little bugger. The virus/worm is a big vbscript that spreads by email (smells like Melissa :))
and infects every script on your computer.

Lifecycle
------------------------------------------------------------------------------------------------

All starts by opening an attachment on an email, then the script starts.
It copies itself into:
$windir/Win32DLL.vbs ($windir = c:\windows on most windows systems)
$systemdir/MSKernel32.vbs ($systemdir = c:\windows\system)
$windir/LOVE-LETTER-FOR-YOU.TXT.vbs
Next it adds those files in the registry so they auto-start on boot.

After that it changes the default page of internet explorer, that way it downloads an executable
from a site when IE opens. If the file has already been downloaded it also adds that into the
registry and changes the default page to "about:blank".

Then it starts sending emails with the script attached to all the people in your addresslist
Finally the big mess starts, the virus scans every harddisk and networkdisk for extentions:
Vbs, vbe, js, jse, css, wsh, sct, hta, vbs, jpg, jpeg
All files found are overwritten by the virus and when mp2's or mp3's are found it copies itself
to a vbs script in the same directory. And when mIRC is found a small mIRC script is created
which sends an html page, which tries to infect you using IE, to every user that joins a channel
you're in.

executable
------------------------------------------------------------------------------------------------

It cracks the share passwords and sends those + ipaddr by email to the creator of this virus
(I couldn't get this program because the server was shutdown, thanks to G0Dfarter for checking it)

Disinfection
------------------------------------------------------------------------------------------------

Open regedit and start deleting the malicious entries
HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run\MSKernel32
HKEY_HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\RunServer\Win32DLL
HKEY_HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run\WIN_BUGSFIX

Search for WIN-BUGSFIX.exe and remove it.
Remove $dirsystem\LOVE-LETTER-FOR-YOU.HTM

Check files with extensions: Vbs, vbe, js, jse, css, wsh, sct, hta, vbs, jpg, jpeg and check for
infection, if so delete them (and replace them with the original).

If you have mIRC is installed remove the script.ini file.
Remove all the emails, maybe warn the people in your addresslist so they don't open the attachment.

Prevention
------------------------------------------------------------------------------------------------


There is only 1 rule in these cases: do NOT open suspicious files
The number one cause why this virus is so affective is that in windows everything is linked.
You can control your entire computer from a simple wordmacro (and worst).
The best thing to do is turn off all sorts of scripting in windows (if possible).

Lamagra access-granted@geocities.com http://lamagra.seKure.de
Member of b0f/buffer0verfl0w security http://www.b0f.com
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close