loveletter virus is back and it's NOT a hoax

CSRT Alert
----------

VBS.Lopez Vandal

Alias: LOVELETTER.CM@MM, JENNIFERLOPEZ.WORM, LOVELETTR.CN,
VBS_NAKEDBEACH.A, NAKEDBEACH.A
Threat Level: Medium
Type: Worm
Platforms: Windows 95/98/ME/NT/2000
Updated on: 4-June-2001

This is a variant of the LoveLetter with a dangerous payload added in the
form of the CIH virus is hexadecimal code which is converted to an executed
file by the VBScript and installed on the victim PC. The vandal arrives by
email as an attached file. It also destroys various multimedia, image and
script files it finds on the infected PC.
All versions of eSafe products already block this vandal!

Analysis
VBS.Lopez arrives in an email message with the following format:

Subject: Where are you?

Message body:

This is my pic in the beach!

Attached file: JENNIFERLOPEZ_NAKED.JPG.VBS

When the attached file is executed, it attempt to overwrite various files
on the system with its own code. It searches for files with the following
extensions: VBS, VBE, JS, JSE, CSS, WSH, SCT, HTA, JPG, JPEG. It appends
the file name and adds the VBS extension after the original extension and
then deletes the original files. This is similar to the LoveLetter vandal.
All eSafe products are protected against LoveLetter vandal and its
variants.
It then attempts to convert a version of the CIH virus which is encoded
inside the script into an executable file named CIH_14.EXE. The system
might get infected upon the next reboot. CIH is an extremely dangerous EXE
virus that can corrupt hard disc and CMOS data. All eSafe products are
protected against CIH virus.

eSafe Users
All eSafe products automatically block and remove this vandal as well as
CIH and LoveLetter that were also mentioned.