Information About the VBS.LOVELETTER Worm Virus

After you receive an e-mail message with an "'ILOVEYOU' Message 'kindly check the attached LOVELETTER coming from me'" subject and a LOVE-LETTER-FOR-YOU.TXT.vbs attachment, you may experience the following behaviors on your computer:

• Files with the following file name extensions may be replaced with the same file name but with an added .vbs file name extension, or the files may be hidden and copies of the files may be created with an added .vbs file name extension:
  .bat
  .com
  .css
  .doc
  .gif
  .hta
  .htm
  .html
  .ini
  .jpg
  .jpeg
  .js
  .jse
  .mp2
  .mp3
  .sct
  .txt
  .vbe
  .vbs
  .wav
  .wsh
  .xls
  Note If you are running Microsoft Windows 2000 or Windows XP, you may receive the following message repeatedly as these files are replaced:
  Windows File Protection Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files.
• The LOVE-LETTER-FOR-YOU.HTM file may be on your computer. If you have installed an Internet Chat Relay client on your computer, the Script.ini file for that client may also be replaced.
• When you send mail to recipients in your Microsoft Outlook address book, the LOVE-LETTER-FOR-YOU.TXT.VBS file may be automatically sent with the message.
• The Win-bugsfix.exe file may be on your computer.
• Your default home page in Internet Explorer may have changed.

This behavior may occur if your computer is infected with the VBS.LOVELETTER worm virus or with a variation of that virus.

Microsoft does not offer software for virus detection or removal. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software from a vendor that is commercially involved in virus detection and removal. For additional information about third-party antivirus software and vendors, click the following article number to view the article in the Microsoft Knowledge Base:

Recommended Updates

Scriptlet.typelib or Eyedog vulnerability: Malformed e-mail header vulnerability: Outlook e-mail security updates: