VBS.NewLove.A

SARC, in conjunction with other anti-virus vendors, has renamed this worm from VBS.LoveLetter.FW.A to VBS.NewLove.A.

The VBS.NewLove.A is a worm, and spreads by sending itself to all addresses in the Outlook address book when it is activated. The attachment name is randomly chosen, but will always have a .Vbs extension. The subject header will begin with "FW: " and will include the name of the randomly chosen attachment (excluding the .VBS extension) Upon each infection, the worm introduces up to 10 new lines of randomly generated comments in order to prevent detection.

Protection

• Initial Rapid Release version May 18, 2000
• Latest Rapid Release version July 12, 2008 revision 018
• Initial Daily Certified version May 18, 2000
• Latest Daily Certified version July 12, 2008 revision 019
• Initial Weekly Certified release date pending

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: More than 1000
• Number of Sites: 3 - 9
• Geographical Distribution: Medium
• Threat Containment: Moderate
• Removal: Difficult

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low