1. Symantec/
  2. Security Response/
  3. VBS.Liong@mm


Risk Level 2: Low

June 25, 2001
February 13, 2007 11:48:25 AM
Also Known As:

VBS.Liong@mm is a minor variant of the LoveLetter virus family. This variant does not contain the viral overwriting function found in many of the variants, but it does contain mass-mailing and network-awareness functions.

The email arrives in the following format:

Subject: One of this mail
Body: True Story....
Attachment: mylinong.exe

Norton AntiVirus detects the attachment as W32.Liong.

This worm modifies the registry so that the worm is run when Windows starts. The worm creates the file Mylinong.hta and displays it the first time that the worm is executed. This HTML page contains a note from the author of the script to his love.

NOTE: Virus definitions dated prior to July 3, 2001, detect this script as VBS.LoveLetter.CQ.

After the worm has resided on an infected system for more than 14 days, the next that time it executes it will delete all of the files and folders that it created.

  • If you are using Norton AntiVirus 2001, a free program update that includes Script Blocking is available. Please run LiveUpdate to obtain this.
  • For other versions of Norton AntiVirus, SARC offers a tool to disable the Windows Scripting Host.

Antivirus Protection Dates

  • Initial Rapid Release version June 25, 2001
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version June 25, 2001
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Brian Ewell

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube