Software

Don't let any of the other users open the message. Isolate her computer from the rest of the network.
I'll send you instructions as I did on my network.
We'll have to wait for the AV companies as to what to do once infected. Nothing has been posted.
Good Luck!

try this vbs script but use at you own risk

rem *** I love You virus cleaner (fast edit no guarantee) **
rem *** Copyright TEQ-nederland www.teq.nl (fvs)

dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
on error resume next
Set fso = CreateObject("Scripting.FileSystemObject")
Set dirwin = fso.GetSpecialFolder(0)
Set dirsystem = fso.GetSpecialFolder(1)
Set dirtemp = fso.GetSpecialFolder(2)
Set c = fso.GetFile(WScript.ScriptFullName)

deleteafile(dirsystem&"\MSKernel32.vbs")
deleteafile(dirwin&"\Win32DLL.vbs")
deleteafile(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
deleteafile(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT")
deleteafile(dirsystem&"\LOVE-LETTER-FOR-YOU.HTM")
deleteafile(dirtemp&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
deleteafile(dirtemp&"\LOVE-LETTER-FOR-YOU.TXT")

Dim num,downread
regcreate
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
",""
regcreate
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi
n32DLL",""
reg

I had the I LOVE YOU - .vbs virus on a computer in our network.

What I did - since there there istn?t a really good medecine right now, was like this:

1. I saved the LOVE-LETTER-FOR-YOU.TXT.vbs as filname.vbs

2. right-click on the new file - select edit.

3. Printed out the whole document.

4. started regedit.

5. changed every created key in registry (create new registry key in the filename.vbs document). Then deleted these keys in the registry.

6. then I searched for love and vbs throughout the whole registry. Deleted suspisious items. Found some in the temp internet files..and so on.

7. Restart of computer. Then I haven?t had any problems yet with the virus.

For some explanation I must display that we have the *.pst file from Outlook at the Novell 4.11 server. And the client was a win98SE computer. I saw some lurking stuff about services in the *.vbs file, so perhaps it will do more damage on an WINNT-driven computer.

Good luck to you all..and there is always a better way. :-

The virus is particularly nasty and rewrites an awful lot of files. Be aware that it writes itself into the registry so that even if you clean the PC the next time it boots it will reinstall itself. Norton and F-Protect have both developed patch solutions available for download that will detect and clean - I am sure the others will have them with 24 hours as well. I have shut down my Internet email Gateway for the day to prevent any further intrusions until I can get the antiviral patch. Good Luck.

This is the solutions posted on Symantec's Site:Removal:


Find and delete infected files
Remove the registry key

HKLM\Software\MicrosoftWindows\CurrentVersionRun\WIN-BUGSFIX


Restore your Internet Explorer Start Page