The Love Bug

1
The Love Bug

• Microsofts Response
• Ted Williamson
• Principal Consultant
• Microsoft Consulting Services

2
What is the Love Bug?

• Information on the VBS/Loveletter Virus
• A new virus is circulating through e-mail and
  affecting many customers. If run, the virus could
  overwrite .jpg, .mp3, and other file types, and
  attempt to send a copy of itself to everyone in
  the recipients address book. All major
  anti-virus vendors have updated signature files
  available that will detect and delete the virus.

3
How Does it Work?

• The e-mail containing the virus typically carries
  a subject line of "ILOVEYOU". Inside the mail is
  a short text message saying "Kindly check the
  attached LOVELETTER coming from me" and an
  attachment named LOVE-LETTER-FOR-YOU.txt.vbs. The
  attachment is the virus payload.

4
Caveats

• Its important to note that the virus payload
  cannot run by itself. In order for it to run, the
  recipient must open the mail, launch the payload
  by double-clicking on it, and answer "yes" to a
  dialogue that warns of the dangers of running
  untrusted programs.

5
Precautions

• Users can avoid being affected by this virus by
  following standard best practices
• Never run an executable attachment, unless you
  fully understand its origin and purpose.
• Always have a good-quality virus scanner
• Always keep the virus scanners signature files
  up to date.

6
Microsofts Response

• Two security updates to Outlook are available to
  help protect against malicious programs like
  worms and viruses
• A file attachment update is available for Outlook
  97, Outlook 98 and Outlook 2000 This update makes
  it more difficult to inadvertently launch
  attachments, by providing a more explicit warning
  dialogue, and preventing attached executables
  from being launched directly from e-mails. The
  update also is included as part of Office 2000
  SR1.

7
More Outlook Fixes

• A security update will soon be available for
  Outlook 98 and 2000. This update will provide
  even greater protection than the file protection
  update. It prevents certain types of attached
  files from ever being opened or saved to disk,
  ensures that customers are alerted anytime a
  program attempts to send mail on their behalf,
  and changes the default Security Zone in which
  mail is processed.
• In addition, a tool is available for Exchange
  administrators that will let them strip
  attachments from all incoming mails. Information
  on this tool is available in Microsoft Knowledge
  Base article Q224493.

8
The Levels of Security

• Level 1 ("Unsafe")
• The "unsafe" category represents any extension
  that may have script or code associated with it.
  Any attachment with an "unsafe" file extension is
  inaccessible if you use a version of Outlook that
  has the security patch applied to it

9
Level 2

• Level 2 Level 2 files are not "unsafe" but they
  do require more security than other attachments.
  When you receive a Level 2 attachment, you are
  prompted to save the attachment to a disk you
  cannot open the attachment from within the
  message. By default, no file extensions are
  associated with this group, however, you can add
  file extensions to the Level 2 list.
• NOTE The list of files that are included in the
  Level 2 category can only be changed if you are
  using Outlook in a Microsoft Exchange Server
  environment and your mail is being delivered to
  an Exchange Server mailbox. These changes must be
  made by an administrator

10
Level 3

• When you try to open an attachment other than
  those in the "unsafe" or Level 2 lists, you are
  prompted to either open the file directly or to
  save it to a disk. You can turn off future
  prompts for that extension if you click to clear
  the Always ask before opening this type of file
  check box.