General discussion
-
CreatorTopic
-
May 4, 2000 at 7:37 am #2081262
“i love you” virus
Lockedby mndthegap1 · about 25 years, 1 month ago
one of the endusers has infected the network with the”i love you” virus. Since it has allready been opened how do i remove the virus from her pc and the rest of the network??????????
Topic is locked -
CreatorTopic
All Comments
-
AuthorReplies
-
-
May 4, 2000 at 7:46 am #3898721
“i love you” virus
by calves · about 25 years, 1 month ago
In reply to “i love you” virus
Don’t let any of the other users open the message. Isolate her computer from the rest of the network.
I’ll send you instructions as I did on my network.
We’ll have to wait for the AV companies as to what to do once infected. Nothing has been posted.
Good Luck!-
June 16, 2000 at 3:40 am #3777495
-
-
May 4, 2000 at 7:46 am #3898720
“i love you” virus
by yorkster · about 25 years, 1 month ago
In reply to “i love you” virus
try this vbs script but use at you own risk
rem *** I love You virus cleaner (fast edit no guarantee) **
rem *** Copyright TEQ-nederland http://www.teq.nl (fvs)dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
on error resume next
Set fso = CreateObject(“Scripting.FileSystemObject”)
Set dirwin = fso.GetSpecialFolder(0)
Set dirsystem = fso.GetSpecialFolder(1)
Set dirtemp = fso.GetSpecialFolder(2)
Set c = fso.GetFile(WScript.ScriptFullName)deleteafile(dirsystem&”\MSKernel32.vbs”)
deleteafile(dirwin&”\Win32DLL.vbs”)
deleteafile(dirsystem&”\LOVE-LETTER-FOR-YOU.TXT.vbs”)
deleteafile(dirsystem&”\LOVE-LETTER-FOR-YOU.TXT”)
deleteafile(dirsystem&”\LOVE-LETTER-FOR-YOU.HTM”)
deleteafile(dirtemp&”\LOVE-LETTER-FOR-YOU.TXT.vbs”)
deleteafile(dirtemp&”\LOVE-LETTER-FOR-YOU.TXT”)Dim num,downread
regcreate
“HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
“,””
regcreate
“HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi
n32DLL”,””
reg-
June 16, 2000 at 3:40 am #3777496
-
-
May 4, 2000 at 7:55 am #3898719
“i love you” virus
by prompt · about 25 years, 1 month ago
In reply to “i love you” virus
I had the I LOVE YOU – .vbs virus on a computer in our network.
What I did – since there there istn?t a really good medecine right now, was like this:
1. I saved the LOVE-LETTER-FOR-YOU.TXT.vbs as filname.vbs
2. right-click on the new file – select edit.
3. Printed out the whole document.
4. started regedit.
5. changed every created key in registry (create new registry key in the filename.vbs document). Then deleted these keys in the registry.
6. then I searched for love and vbs throughout the whole registry. Deleted suspisious items. Found some in the temp internet files..and so on.
7. Restart of computer. Then I haven?t had any problems yet with the virus.
For some explanation I must display that we have the *.pst file from Outlook at the Novell 4.11 server. And the client was a win98SE computer. I saw some lurking stuff about services in the *.vbs file, so perhaps it will do more damage on an WINNT-driven computer.
Good luck to you all..and there is always a better way. :-
-
June 16, 2000 at 3:40 am #3777497
-
-
May 4, 2000 at 8:35 am #3898715
“i love you” virus
by jwittersheim · about 25 years, 1 month ago
In reply to “i love you” virus
The virus is particularly nasty and rewrites an awful lot of files. Be aware that it writes itself into the registry so that even if you clean the PC the next time it boots it will reinstall itself. Norton and F-Protect have both developed patch solutions available for download that will detect and clean – I am sure the others will have them with 24 hours as well. I have shut down my Internet email Gateway for the day to prevent any further intrusions until I can get the antiviral patch. Good Luck.
-
June 16, 2000 at 3:40 am #3777498
-
-
May 4, 2000 at 8:49 am #3898713
“i love you” virus
by calves · about 25 years, 1 month ago
In reply to “i love you” virus
This is the solutions posted on Symantec’s Site:Removal:
Find and delete infected files
Remove the registry keyHKLM\Software\MicrosoftWindows\CurrentVersionRun\WIN-BUGSFIX
Restore your Internet Explorer Start Page
-
June 16, 2000 at 3:40 am #3777499
-
-
May 4, 2000 at 9:22 am #3898710
“i love you” virus
by jmorris · about 25 years, 1 month ago
In reply to “i love you” virus
Here’s another way around it. At least it’s something you could do to clean your Exchange 5.5/5.0 server Store.
http://support.microsoft.com/support/kb/articles/Q224/4/93.ASP?LN=EN-US&SD=gn&FR=0
Then you need to make the criteria file. The syntax goes like this:
MSG ILOVEYOU 2000/05/04
That’s MSGILOVEYOU 2000/05/04
1 space between MSG and ILOVEYOU, 1 tab between ILOVEYOU and the date.-
June 16, 2000 at 3:40 am #3777500
-
-
May 7, 2000 at 8:58 pm #3898622
“i love you” virus
by anp04 · about 25 years, 1 month ago
In reply to “i love you” virus
Down load the fix from http://www.symantec.com/avcenter/venc/data/fix.vbs.loveletter.html
The only hitch is that you need Norton Anti-virus with the latest available patch.
The method of manually removing/de-activating the virus is also given there.
-
June 16, 2000 at 3:40 am #3777501
-
-
-
AuthorReplies