VBS/Loveletter.CN Worm

 Information about the VBS/Loveletter.CN worm:

VBS/Loveletter.CN is a mass mailing email worm, which is similar a variant of VBS/Loveletter worm. This worm will infect Windows systems.

The worm arrives with the subject:

Where are you?

The body of the message reads:

This is my pic in the beach!

Infected email carries an attachment called JENNIFERLOPEZ_NAKED.JPG.vbs. When the attachment is executed it overwrites by its contents on the files having following extensions:
VBS, VBE, HTA, MP3, MP2, JS, JSE, CSS, WSH, SCT, JPG and JPEG.

Apart from VBS and VBE extension files, rest of the files will be renamed in the same name with VBS extension. After this worm sends itself using the Microsoft Outlook address book and modifies registry key to check mass mailing process is executed or not.

HKEY_CURRENT_USER\software\JENNIFFERLOPEZ_NAKED\mailed=1

Registry key will be created to load the worm at startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This worm also drops a dangerous Windows virus Win95.CIH and attempts to execute it. The VBS/Loveletter.CN first appeared in May 2001.

 Other names of VBS/Loveletter:

This worm is also known as VBS_NAKEDBEACH.A, JENNIFERLOPEZ WORM.

 Removing VBS/Loveletter.CN worm from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.