Alias:
Type:Worm 
Size:variable 
Origin: 
Date:05-19-2000 
Damage:Sent by email 
VDF Version:6.01.00.08 
Danger:Low 
Distribution:Low 

DistributionNEWLOVE worm sends itself to all addresses saved in Outlook. The email it sends looks like this:
Subject: PKUPLRX00HB0ZGNEMFHUO.txt
Attachment: PKUPLRX00HB0ZGNEMFHUO.txt.vbs

Technical DetailsIf the worm is activated, by double-click on the infectious attachment, it copies itself in Windows and Windows system directories.

It also makes the registry entries:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\

The worm uses random file names or choses the names of existing files from C:\%WINDIR%\APPLOG. If there are no files in the directory, the worm choses a random name, having between 1 and 31 characters and one of the following extensions: DOC XLS MDB BMP MP3 TXT JPG GIF MOV URL HTM.
Then, it overwrites all 0 Byte files on all local and network drives. It spares only the recently used files or the ones blocked by the system. All files will have .vbs extension. There are more .vbs type extensions.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .