General discussion

Locked

"i love you" virus

By mndthegap1 ·
one of the endusers has infected the network with the"i love you" virus. Since it has allready been opened how do i remove the virus from her pc and the rest of the network??????????

This conversation is currently closed to new comments.

14 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

"i love you" virus

by calves In reply to "i love you" virus

Don't let any of the other users open the message. Isolate her computer from the rest of the network.
I'll send you instructions as I did on my network.
We'll have to wait for the AV companies as to what to do once infected. Nothing has been posted.
Good Luck!

Collapse -

"i love you" virus

by mndthegap1 In reply to "i love you" virus
Collapse -

"i love you" virus

by yorkster In reply to "i love you" virus

try this vbs script but use at you own risk

rem *** I love You virus cleaner (fast edit no guarantee) **
rem *** Copyright TEQ-nederland www.teq.nl (fvs)

dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
on error resume next
Set fso = CreateObject("Scripting.FileSystemObject")
Set dirwin = fso.GetSpecialFolder(0)
Set dirsystem = fso.GetSpecialFolder(1)
Set dirtemp = fso.GetSpecialFolder(2)
Set c = fso.GetFile(WScript.ScriptFullName)

deleteafile(dirsystem&"\MSKernel32.vbs")
deleteafile(dirwin&"\Win32DLL.vbs")
deleteafile(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
deleteafile(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT")
deleteafile(dirsystem&"\LOVE-LETTER-FOR-YOU.HTM")
deleteafile(dirtemp&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
deleteafile(dirtemp&"\LOVE-LETTER-FOR-YOU.TXT")

Dim num,downread
regcreate
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
",""
regcreate
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi
n32DLL",""
reg

Collapse -

"i love you" virus

by mndthegap1 In reply to "i love you" virus
Collapse -

"i love you" virus

by prompt In reply to "i love you" virus

I had the I LOVE YOU - .vbs virus on a computer in our network.

What I did - since there there istn?t a really good medecine right now, was like this:

1. I saved the LOVE-LETTER-FOR-YOU.TXT.vbs as filname.vbs

2. right-click on the new file - select edit.

3. Printed out the whole document.

4. started regedit.

5. changed every created key in registry (create new registry key in the filename.vbs document). Then deleted these keys in the registry.

6. then I searched for love and vbs throughout the whole registry. Deleted suspisious items. Found some in the temp internet files..and so on.

7. Restart of computer. Then I haven?t had any problems yet with the virus.

For some explanation I must display that we have the *.pst file from Outlook at the Novell 4.11 server. And the client was a win98SE computer. I saw some lurking stuff about services in the *.vbs file, so perhaps it will do more damage on an WINNT-driven computer.

Good luck to you all..and there is always a better way. :-

Collapse -

"i love you" virus

by mndthegap1 In reply to "i love you" virus
Collapse -

"i love you" virus

by jwittersheim In reply to "i love you" virus

The virus is particularly nasty and rewrites an awful lot of files. Be aware that it writes itself into the registry so that even if you clean the PC the next time it boots it will reinstall itself. Norton and F-Protect have both developed patch solutions available for download that will detect and clean - I am sure the others will have them with 24 hours as well. I have shut down my Internet email Gateway for the day to prevent any further intrusions until I can get the antiviral patch. Good Luck.

Collapse -

"i love you" virus

by mndthegap1 In reply to "i love you" virus
Collapse -

"i love you" virus

by calves In reply to "i love you" virus

This is the solutions posted on Symantec's Site:Removal:


Find and delete infected files
Remove the registry key

HKLM\Software\MicrosoftWindows\CurrentVersionRun\WIN-BUGSFIX


Restore your Internet Explorer Start Page

Collapse -

"i love you" virus

by mndthegap1 In reply to "i love you" virus
Back to Software Forum
14 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums