Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Sent by email
NEWLOVE worm sends itself to all addresses saved in Outlook. The email it sends looks like this:
If the worm is activated, by double-click on the infectious attachment, it copies itself in Windows and Windows system directories.
It also makes the registry entries:
The worm uses random file names or choses the names of existing files from C:\
\APPLOG. If there are no files in the directory, the worm choses a random name, having between 1 and 31 characters and one of the following extensions: DOC XLS MDB BMP MP3 TXT JPG GIF MOV URL HTM.
Then, it overwrites all 0 Byte files on all local and network drives. It spares only the recently used files or the ones blocked by the system. All files will have .vbs extension. There are more .vbs type extensions.
Description inserted by Crony Walker on Tuesday, June 15, 2004