TechRepublic|Forums|Software

Software

General discussion

  • Creator
    Topic
  • May 4, 2000 at 7:37 am #2081262

    “i love you” virus

    Locked

    by mndthegap1 · about 25 years, 1 month ago

    one of the endusers has infected the network with the”i love you” virus. Since it has allready been opened how do i remove the virus from her pc and the rest of the network??????????

    Topic is locked This conversation is currently closed to new comments.
  • Creator
    Topic

All Comments

  • Author
    Replies
    • May 4, 2000 at 7:46 am #3898721

      “i love you” virus

      by calves · about 25 years, 1 month ago

      In reply to “i love you” virus

      Don’t let any of the other users open the message. Isolate her computer from the rest of the network.
      I’ll send you instructions as I did on my network.
      We’ll have to wait for the AV companies as to what to do once infected. Nothing has been posted.
      Good Luck!

    • May 4, 2000 at 7:46 am #3898720

      “i love you” virus

      by yorkster · about 25 years, 1 month ago

      In reply to “i love you” virus

      try this vbs script but use at you own risk

      rem *** I love You virus cleaner (fast edit no guarantee) **
      rem *** Copyright TEQ-nederland http://www.teq.nl (fvs)

      dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
      on error resume next
      Set fso = CreateObject(“Scripting.FileSystemObject”)
      Set dirwin = fso.GetSpecialFolder(0)
      Set dirsystem = fso.GetSpecialFolder(1)
      Set dirtemp = fso.GetSpecialFolder(2)
      Set c = fso.GetFile(WScript.ScriptFullName)

      deleteafile(dirsystem&”\MSKernel32.vbs”)
      deleteafile(dirwin&”\Win32DLL.vbs”)
      deleteafile(dirsystem&”\LOVE-LETTER-FOR-YOU.TXT.vbs”)
      deleteafile(dirsystem&”\LOVE-LETTER-FOR-YOU.TXT”)
      deleteafile(dirsystem&”\LOVE-LETTER-FOR-YOU.HTM”)
      deleteafile(dirtemp&”\LOVE-LETTER-FOR-YOU.TXT.vbs”)
      deleteafile(dirtemp&”\LOVE-LETTER-FOR-YOU.TXT”)

      Dim num,downread
      regcreate
      “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
      “,””
      regcreate
      “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi
      n32DLL”,””
      reg

    • May 4, 2000 at 7:55 am #3898719

      “i love you” virus

      by prompt · about 25 years, 1 month ago

      In reply to “i love you” virus

      I had the I LOVE YOU – .vbs virus on a computer in our network.

      What I did – since there there istn?t a really good medecine right now, was like this:

      1. I saved the LOVE-LETTER-FOR-YOU.TXT.vbs as filname.vbs

      2. right-click on the new file – select edit.

      3. Printed out the whole document.

      4. started regedit.

      5. changed every created key in registry (create new registry key in the filename.vbs document). Then deleted these keys in the registry.

      6. then I searched for love and vbs throughout the whole registry. Deleted suspisious items. Found some in the temp internet files..and so on.

      7. Restart of computer. Then I haven?t had any problems yet with the virus.

      For some explanation I must display that we have the *.pst file from Outlook at the Novell 4.11 server. And the client was a win98SE computer. I saw some lurking stuff about services in the *.vbs file, so perhaps it will do more damage on an WINNT-driven computer.

      Good luck to you all..and there is always a better way. :-

    • May 4, 2000 at 8:35 am #3898715

      “i love you” virus

      by jwittersheim · about 25 years, 1 month ago

      In reply to “i love you” virus

      The virus is particularly nasty and rewrites an awful lot of files. Be aware that it writes itself into the registry so that even if you clean the PC the next time it boots it will reinstall itself. Norton and F-Protect have both developed patch solutions available for download that will detect and clean – I am sure the others will have them with 24 hours as well. I have shut down my Internet email Gateway for the day to prevent any further intrusions until I can get the antiviral patch. Good Luck.

    • May 4, 2000 at 8:49 am #3898713

      “i love you” virus

      by calves · about 25 years, 1 month ago

      In reply to “i love you” virus

      This is the solutions posted on Symantec’s Site:Removal:

      Find and delete infected files
      Remove the registry key

      HKLM\Software\MicrosoftWindows\CurrentVersionRun\WIN-BUGSFIX

      Restore your Internet Explorer Start Page

    • May 4, 2000 at 9:22 am #3898710

      “i love you” virus

      by jmorris · about 25 years, 1 month ago

      In reply to “i love you” virus

      Here’s another way around it. At least it’s something you could do to clean your Exchange 5.5/5.0 server Store.

      http://support.microsoft.com/support/kb/articles/Q224/4/93.ASP?LN=EN-US&SD=gn&FR=0

      Then you need to make the criteria file. The syntax goes like this:

      MSG ILOVEYOU 2000/05/04
      That’s MSGILOVEYOU2000/05/04
      1 space between MSG and ILOVEYOU, 1 tab between ILOVEYOU and the date.

    • May 7, 2000 at 8:58 pm #3898622

      “i love you” virus

      by anp04 · about 25 years, 1 month ago

      In reply to “i love you” virus

      Down load the fix from http://www.symantec.com/avcenter/venc/data/fix.vbs.loveletter.html

      The only hitch is that you need Norton Anti-virus with the latest available patch.

      The method of manually removing/de-activating the virus is also given there.

  • Author
    Replies
Viewing 6 reply threads