Alias:VBS.LoveLetter.C
Type:Worm 
Size:17.245 Bytes 
Origin: 
Date:06-01-2001 
Damage:Sent by email. 
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:High 

DistributionThe worm spreads over Microsoft Outlook email program and sends itself to all contacts found in the Address Book.
An email sent by the worm looks like this:

Subject: Where are you?

Body: This is my pic in the beach!

Attachment: JENNIFERLOPEZ_NAKED.JPG.vbs

Technical DetailsIf the file JENNIFERLOPEZ_NAKED.JPG.vbs is opened, the worm copies itself in c:\windows. Then, the worm registers twice:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunWORM"="wscript.exe C:\\WINDOWS\\JENNIFERLOPEZ_NAKED.JPG.vbs % HKEY_CURRENT_USER\Software\JENNIFFERLOPEZ_NAKED @="Worm made in algeria" mailed"="1

The worm searches all drives and mapped network drives for files with extension:
*.vbs *.vbe *.js *.jse *.css *.wsh *.sct *.hta *.jpg *.jpeq *.mp3 *.mp2
All these files are overwritten with the virus code.

Finally, the virus "W95/CIH.A" is dropped in "C:\%windDir%\". The file name is "Cih_14.exe".
说明添加者： Crony Walker 打开 2004年6月15日星期二

反馈 . . . .

© 2013 Avira Operations GmbH & Co. KG. 保留所有权利.

我的帐户

https:// 为了你的安全，此窗口已加密。