Home Malware Programs Worms Worm.Mail.Win32.LoveLetter.a

Worm.Mail.Win32.LoveLetter.a

Posted: January 13, 2011

Worm.Mail.Win32.LoveLetter.a is a very dangerous computer worm which crawls from from mailbox to mailbox via removable drives. Symptoms of this infection will start with a romantic letter (email) appearing in the user's mailbox. The letter is usually a confession of love by some unkown person. The deceptive email is used to lure hapless computer users into downloding the worm onto the system. Once active its destructive payload will start running riot on the system. Symptoms include system depreciation, loss of important documents and files and eventually a system crash will occur. Worm.Mail.Win32.LoveLetter.a should be removed immediately. Do not give this malicious cyber pest a chance to spread. Experts recommend using a registered malware remover which ranks high in the computer security world.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %appdata%\microsoft\internet explorer\quick launch\Worm.Mail.Win32.LoveLetter.a.lnk
    2 %commonprograms%\Worm.Mail.Win32.LoveLetter.a\about.lnk
    3 %commonprograms%\Worm.Mail.Win32.LoveLetter.a\activate.lnk
    4 %commonprograms%\Worm.Mail.Win32.LoveLetter.a\buy.lnk
    5 %commonprograms%\Worm.Mail.Win32.LoveLetter.a\scan.lnk
    6 %commonprograms%\Worm.Mail.Win32.LoveLetter.a\settings.lnk
    7 %commonprograms%\Worm.Mail.Win32.LoveLetter.a\update.lnk
    8 %commonprograms%\Worm.Mail.Win32.LoveLetter.a\Worm.Mail.Win32.LoveLetter.a support.lnk
    9 %commonprograms%\Worm.Mail.Win32.LoveLetter.a\Worm.Mail.Win32.LoveLetter.a.lnk
    10 %desktop%\Worm.Mail.Win32.LoveLetter.a support.lnk
    11 %desktop%\Worm.Mail.Win32.LoveLetter.a.lnk
    12 %programfiles\Worm.Mail.Win32.LoveLetter.a\about.ico
    13 %programfiles\Worm.Mail.Win32.LoveLetter.a\activate.ico
    14 %programfiles\Worm.Mail.Win32.LoveLetter.a\buy.ico
    15 %programfiles\Worm.Mail.Win32.LoveLetter.a\def.db
    16 %programfiles\Worm.Mail.Win32.LoveLetter.a\defcnt.exe
    17 %programfiles\Worm.Mail.Win32.LoveLetter.a\defext.dll
    18 %programfiles\Worm.Mail.Win32.LoveLetter.a\defhook.dll
    19 %programfiles\Worm.Mail.Win32.LoveLetter.a\help.ico
    20 %programfiles\Worm.Mail.Win32.LoveLetter.a\scan.ico
    21 %programfiles\Worm.Mail.Win32.LoveLetter.a\settings.ico
    22 %programfiles\Worm.Mail.Win32.LoveLetter.a\splash.mp3
    23 %programfiles\Worm.Mail.Win32.LoveLetter.a\uninstall.exe
    24 %programfiles\Worm.Mail.Win32.LoveLetter.a\update.ico
    25 %programfiles\Worm.Mail.Win32.LoveLetter.a\virus.mp3

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}hkcu\Software\Microsoft\Windows\CurrentVersion\Run “Worm.Mail.Win32.LoveLetter.a”hklm\SOFTWARE\Worm.Mail.Win32.LoveLetter.aHKEY..\..\..\..{RegistryKeys}hkcr\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Worm.Mail.Win32.LoveLetter.a
Loading...