Information on vbs/loveletter.cx worm

[tribezmaan]

Two days ago our fileserver started turning up files infected with the vbs/loveletter.cx worm. The CA eTrust 6.0.96 with the InoculateIT scan engine with the latest virus definition file (08/29/02) could not cure the infection.

Attempting a remote scan was impossible because the scanner simply was not allowed to access the infected machine.

A search on the net turned up no information at all on this virus and I would appreciate any help at all.

tribezmaan

 

[jnicks]

I also could not find loiveletter.cx, but most of the lover letters are simple minded variants of Guzman's simple minded original.

I did find loveletter.a, .b, ... .x, ... .bj but nowhere near cx.


Do you have files:

%sysdir%\MSKernel32.vbs
%sysdir%\LOVE-LETTER-FOR-YOU.TXT.vbs
%windir%\Win32DLL.vbs

?

I'd go to

http://www.europe.f-secure.com/v-descs/love.shtml

and pick up their demonstration kit and it will almost certainly get rid of a simple minded variant of Guzman's simple minded original LoveLetter vbs.

 

[AVChap]

Here's the results from a VGREP of LoveLetter.CX:

ALWIL [undetected]
H+BEDV VBS/LoveLetter.D
GRISoft [undetected]
Kaspersky Lab I-Worm.LoveLetter
SOFTWIN VBS.LoveLetter.A
Dialogue Science VBS.LoveLetter
Frisk Software VBS/LoveLetter.gen
McAfee VBS/LoveLetter@MM
IKARUS [undetected]
MkS [undetected]
Symantec VBS.LoveLetter.A
ESET [maybe] VBS/LoveLetter.A worm
Norman mIRC/Gen_HTM
Panda VBS/LoveLetter
Trend Micro VBS_LOVELETTER.A
GeCAD RAV VBS/LoveLetter.AE*
Sophos [undetected]
CA VET [undetected]
CA InoculateIT VBS/LoveLetter.CX.Worm
VirusBuster [undetected]
HAURI [undetected]

Look for descriptions of these in the AV vendors' site.

HTH,
AVChap

 

[jnicks]

Hey chappie,

is the Vgrep search you did at, like:

http://toronto.virusbtn.com/search.cgi?terms=loveletter.cx

[tt]
Summary
0 results found 'loveletter.CX'. No results to display.
No Results
[/tt]

Since Tribeszmaan said ll.cx, I guess he meant that and not the others.

btb, I went to CA's site and ran a few searches,

[tt]
Simple search results for: loveletter.cx
Your search found no matching documents!
[/tt]

How can I reproduce your result?

 

[AVChap]

I ran it from this site:

http://www.virusbtn.com/resources/vgrep/index.xml

This is updated on a regular basis by one of the researchers from NAI.

I got 47 hits looking for "loveletter.cx"

AVChap