Appendix B. Variants
The CERT Coordination Center has received reports of worms that are
nearly identical or are very similar to the Love Letter worm. The
information provided above applies to these variants except as noted
below. This section is not intended to be comprehensive, and we are
aware of reports involving additional variants not described here.
Joke / Very Funny
This variant changes several references to
LOVE-LETTER-FOR-YOU in the source code to Very Funny.
This primarily results in an email attachment name Very
Funny.vbs. The email messages sent by this variant have a subject
of "fwd: Joke", and an empty message body.
Mothers Day
The subject of this variant is "Thanks for your purchase!" and the
body of the message contains:
-
We have proceeded to charge your credit card for the amount
of $326.92 for the mothers day diamond special. We have attached a
detailed invoice to this email. Please print out the attachment and
keep it in a safe place. Thanks Again and Have a Happy Mothers Day!
This variant infects files as previously described, with the
exception of jpg and jpeg files. Instead, this variant
infects ini and bat in a similar way. Specifically, for
files whose extension is ini or bat, it will replace
those files with a copy of the worm and add a vbs extension.
For example, a file named x.ini will be replaced by a file
called x.ini.vbs containing a copy of the worm.
This variant also includes different URLs for the Internet Explorer
Start Page.
The CERT Coordination Center thanks David Slade of Lucent
Technologies for help in constructing this advisory; Christopher
Lindsey for the providing the procmail rule; and Jeff Rife for
catching an error in an earlier version of this advisory.
The following people were involved in the creation of this
document: Jeff Carpenter, Cory Cohen, Chad Dougherty, Ian Finlay,
Kathy Fithen, Rhonda Green, Robert Hanson, Jeff Havrilla, Shawn
Hernan, Kevin Houle, Brian King, Jed Pickel, Joseph Pruszynski, Robin
Ruefle, John Shaffer, and Mark Zajicek
This document is available from: