>>>>>Garrett,
>>>>>
>>>>>Has MS officially notified the press about the danger that the ILY worm poses for VFP/FP users?
>>>>
>>>>Al,
>>>>
>>>>It isn't going after SCT files because it thinks they're VFP files. It goes after them because it thinks that they're Windows Script Component files. The two share the same extension. BTW, DBC index files (extension DCX) can be mistaken for image files.
>>>
>>>George in the virus code can you tell me what it is trying to do with the CSS, JSE, and JS files?
>>
>>Bret,
>>
>>I can't tell you what it's trying to do (I haven't seen the code). However, both JS and JSE files are JScript (Java Script) files. If you gotten very far in the WSH Programmers Reference yet, you know that these are also WSH files. One meaning for the CSS extension is that it's a Hyper Text Style Sheet. Does that help?
>
>Have not got that far yet (just started today), but the ocde of the virus seems to open the CSS, JSE, JS files and my worry is that it writes to the files after opening and inserts its code. Thus when a user runs any of those files in their normal fashion then the virus starts all over again.
>
>The code can be found at http://www.simplifiedtc.com/Iloveyouvirus.txt
Bret,

The virus writes it's copy over all files with extensions js, jse, css, wsh, sct and hta on all accesible drives. Each file than is copied into file with the same name but extension VBS and deleted.