VBS.Liong@mm is a minor variant of the LoveLetter virus family. This variant does not contain the viral overwriting function found in many of the variants, but it does contain mass-mailing and network-awareness functions.
The email arrives in the following format:
Subject: One of this mail
Body: True Story....
Norton AntiVirus detects the attachment as W32.Liong.
This worm modifies the registry so that the worm is run when Windows starts. The worm creates the file Mylinong.hta and displays it the first time that the worm is executed. This HTML page contains a note from the author of the script to his love.
Virus definitions dated prior to July 3, 2001, detect this script as VBS.LoveLetter.CQ.
After the worm has resided on an infected system for more than 14 days, the next that time it executes it will delete all of the files and folders that it created.
- If you are using Norton AntiVirus 2001, a free program update that includes Script Blocking is available. Please run LiveUpdate to obtain this.
- For other versions of Norton AntiVirus, SARC offers a tool to disable the Windows Scripting Host.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.