This  is a polymorphic Visual Basic Script worm that mutates its appearance in an attempt to avoid detection.

As of 18 May 2000, a new, more destructive variant of the LOVE LETTER worm, NewLove.VBS, has been identified. Like the earlier variants, this worm is transmitted via email, but unlike the others, this new polymorphic variant can change the subject line and the program code every time it is retransmitted, thus making it more difficult for users and anti-virus programs to detect. The worm is transmitted when a user opens an email attachment.

The NewLove.VBS variant uses the filename of a file that a user has recently been working on, and places that filename in the subject line of the email transmission. The recipient may think that they have been forwarded a file from a known associate. When the attachment is opened, this worm can damage all files not currently in use, by changing the file extensions to .VBS. It can also transmit itself to a new group of victims taken from the current victim's email address book. The new email will have a different subject line taken from a filename that the current victim has recently been working on.

VBS.NewLove.A

Subject:
Variable; "FW: filename.ext" (where filename.ext is dervied from the user's recently opened documents list)

Attachment:
Variable; "filename.ext.vbs" (where filename.ext is dervied from the user's recently opened documents list)

It will overwrites all files that are not currently in use regardless of extension.

It will overwrite files on all mapped local drives (with the exception of files in root directories)

The filename attached will have one of the following extensions:

Doc.Vbs, Xls.Vbs, Mdb.Vbs, Bmp.Vbs, Mp3.Vbs, Txt.Vbs, Jpg.Vbs, Gif.Vbs, Mov.Vbs, Url.Vbs, Htm.Vbs

The message has the subject line: "FW: <filename>" where filename is the name of the file it is forwarding, with the extension ".Vbs" removed. So, if the attached infected file is README.DOC.Vbs then the subject line will be "FW: README.DOC".

Because of this VBS/NewLove-A does not use the same filename or subject line on different infections.

The email message has no message text.

The virus attempts to reduce all files on local and remote drives to zero. This means that Windows may stop working correctly, and that your system will not start up properly upon reboot.

Users who have disabled Windows Scripting Host (WSH) on their computers will not be infected by this virus.

Users who are blocking any Visual Basic Script filename (the infected message always arrives with end suffix of ".Vbs" on the filename will not be affected.

Due to the way in which the virus mutates it rapidly increases in size on each infection. This means that your mail server may become increasingly slowed down by larger and larger amounts of email.

The FBI has opened an investigation into this activity. Please report any evidence of infection to your local FBI office, NIPC, military, or civilian computer incident response group, as appropriate. The NIPC Watch and Warning Unit can be reached at (202) 323-3204/5/6.