Hello Everyone,

I'm new to this list and mostly just trying to read, but this just came in
on another owners' list with the recommendation to watch out for it and
filter, if possible on the attachment name and subject lines.  One US list
owner has seen several of these attachments come through already.

Now if someone knows how to set in the Listserv Header a Filter for an
attachment name or a Subject Line, I'd appreciate hearing how it is done!

Molly
[log in to unmask]

----------------------------------------------------------------------
Symantec Platinum Support Bulletin
 >
**********************************************************************
 > There is a mass breakout of a new worm, which the Symantec AntiVirus
 > Research Center is currently calling VBS.LoveLetter.A.
 >
 > It was discovered a few hours ago in Europe, and has already hit
 > several large European Corporations. It is likely to hit the US
quickly.
 >
 > Symantec European tech support has already received many calls
 > from corporations ht by this new virus and SARC believes
 > it could be as bad as the Melissa virus that hit last year.
 >
 > Although SARC does not yet have a cure for this worm, we hope by
 > providing this preliminary information, it will help admins make
 > email configurations which can filter for the subject line and
attachment name.
 > SARC is currently working on a new virus definition for this.
 >
 > This is preliminary information.  It is subject to change as we
 > learn more about this virus.
 >
 > For current information, please check the SARC web site:
 >
 > http://www.symantec.com/avcenter
 >
 > ***
 >
 > VBS.LoveLetter.A  is an email worm, mIRC worm, and file infector.
 > Threat Assessment:  High
 > Payload:
 > Large scale e-mailing: All the addresses in
 > Microsoft Outlook address book
 > Degrades performance: May clog mail servers
 >
 > Distribution:  email
 >
 > Subject of e-mail: ILOVEYOU
 > Name of attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
 > Size of attachment: 10307
 >
 > SARC recommends Administrators filter on the attachment name
 > And Subject line immediately.
 >
 > Technical description:
 >
 > This is a preliminary writeup. The information contained within
is
 > to provide as much information as possible at this time, and is
 > VBS.LoveLetter.A is an email worm, mIRC worm, and a file
 > infector.
 >
 > VBS.LoveLetter.A will use Microsoft Outlook and email
 > itself out as an attachment with the above subject line and
 > attachment name. The body of the message will be
 > kindly check the attached LOVELETTER coming from me.
 >
 > The virus will also infect files with the following extensions:
vbs,
 > vbe, js, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2
 >
 > The virus will drop the following files:
 >
 > MSKernel32.vbs in the Windows System directory
 > Win32DLL.vbs in the Windows directory
 > LOVE-LETTER-FOR-YOU. TXT.vbs in the Windows System
 > WinFAT32.EXE in the Internet download directory
 > script.ini in the mIRC directory
 > SARC recommends Administrators filter on the attachment name
 > And Subject line immediately.
 >
 >  Removal: Delete found infected files.
----------------------------------------------------------------------