Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.



06 June 2000
11 October 2001
Systems Affected:
The VBS.Loveletter.AS variant is a mass-mailing worm first reported on June 6, 2000.

Like the original VBS.LoveLetter.A, this variant spreads through Microsoft Outlook and replaces file contents with infectious copies of itself.

The variant triggers on September 17 of any year, executing the email payload and displaying a greeting message.

The worm also attempts to download and install files from three specfic websites. These have since been disabled.

Antivirus Protection Dates

  • Initial Rapid Release version 16 June 2000
  • Latest Rapid Release version 08 August 2016 revision 023
  • Initial Daily Certified version 16 June 2000
  • Latest Daily Certified version 09 August 2016 revision 001
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
VBS.Loveletter.AS is a mass-mailing worm first reported early on June 6, 2000.

The virus is executed by a user running an infected email attachment.

On first execution, the worm writes copies of itself to the \Windows folder:


and one of

\Windows\System\[random filename].bmp.vbs


\Windows\System\[random filename].jpg.vbs


\Windows\System\[random filename].gif.vbs

The worm replaces files of certain types with its own code, and adds an extension of '.vbs' to the filename. In most reported variants, these include the following file types:

.vbs, .vbe, .js, .jse, .css, .wsh, .sct, .hta, .jpg, .jpeg, .wav, .txt, .gif, .doc, .htm, .html, .xls, .ini, .bat, .com, .mp3, and .mp2.

.mp3 and .mp2 files are hidden rather than overwritten.

The worm also creates this file:


The worm checks for this file:


If it is unable to find Winfat32.exe, it will try to download one of three files from a remote location, set the Internet Explorer's default home page to the address chosen, and take a specific action:
- the worm saves as \Windows\ and changes the registry to execute the worm on startup.
- copies to \Windows\Syslogos.sys, replacing the Windows shutdown screen.
- copies to \Windows\, replacing the Windows "safe to turn off your computer" screen.

Since the virus' appearance, these websites have been made unavailable.