Intelligence Services has received unconfirmed reports that possible FTP download sites containing hcheck.exe are hosted at the National Institutes of Health and Michigan State University. After successful execution, the worm creates a file named cfile.bat, which it then executes to delete all files it created, including itself. LoveLetter.db is also known as DUNpws.bo, Loveletter.ad, resume.txt.vbs, Trojan. Customers who have applied the Microsoft Outlook Security Upgrade are not vulnerable to this attack due to the changes in handling of .VBS files. While LoveLetter.db is not widespread at the moment, infections have been reported in Switzerland and Russia.
Unconfirmed reports claim the worm is spreading throughout Europe.
This worm marks a growing trend in using a virus or worm not for destructive purposes, but to steal sensitive information or carry out other activity without the victim's knowledge. LoveLetter.db demonstrates the ability of an attacker to craft a worm to gain particular information and facilitate further exploits. To adequately assess an organization's security needs and implement the proper security measures, it is essential that there is an understanding of the full range in which malicious actors can utilize viruses and worms. These factors should be considered in current planning and in a reevaluation of existing measures. LoveLetter.db demonstrates that known vulnerabilities, exploits, and viruses can still carry a significant impact.