[Home] [About Us] [FAQs] [Announcements] [Tech Support] [Time On-Line] [Account Change Form]

Another Virus to deal with read this and be warned!.......

Virus/Worm Name: VBS Love Letter
Date Identified:       May 4, 2000
Description:   VBS.LoveLetter.A is an email worm, mIRC worm, and a file infector. VBS.LoveLetter.A will use Microsoft Outlook (so you don't have to read any farther than this if you use another e-mail program other than Microsoft Outlook or Microsoft Outlook Express) and email itself out as an attachment with the following information:

Subject Line: ILOVEYOU
File Attachment Name: LOVE-LETTER-FOR-YOU.TXT.vbs
Body of Message:   kindly check the attached LOVELETTER coming from me.

What does it do?
1. Attempt to send itself to all the e-mails in the address book.
2. On Windows 98 machines it will attempt to download and execute a virus named "WIN-BUGSFIX.exe" from several web sites.
3. It will set the homepage of Internet Explorer to a blank page.
4. It will search all the connected drives and infect VBScript, JavaScript, JScript, and the following file types vbs, vbe, js, jse, css, wsh, sct, hta
5. It will search for all mp3, mp2, jpg, and jpeg files, create a VBS file with the infected file name and a VBS extension. For example, if it finds a file named mysong.mp3 it will create an infected file with the name mysong.mp3.vbs. If this file is run it will infect the system.
6. It will try to send an infected HTML file, named "LOVE-LETTER-FOR-YOU.htm" to mIRC clients.

What to do to remove the virus/worm from your computer (print out this page):
The virus will insert the following files:

1) MSKernel32.vbs in the Windows System directory
2) Win32DLL.vbs in the Windows directory
3) LOVE-LETTER-FOR-YOU.TXT.vbs in the Windows System directory
4) LOVE-LETTER-FOR-YOU.vbs in the Windows System directory
5) LOVE-LETTER-FOR-YOU.htm in the Windows System directory
6) WinFAT32.EXE in the Internet download directory
7) WIN-BUGSFIX.EXE in the Internet download directory
8) script.ini in the mIRC directory

The way to fix your computer is to find each file and remove it from your computer.    There are several ways to accomplish this goal. 

First, you can find the actual directly in your computer as it is shown after the file name.   For example, the MSKernal32.vbs file names says that it is in the Windows System directory.   To find this, double click on MY COMPUTER, then double click on your C DRIVE, then double click on WINDOWS file then double click on SYSTEM file and you should have a very large window of files open on your screen.    Scroll through until you find the file named MSKERNEL32.VBS and click ONCE with your RIGHT mouse button and choose DELETE from the pop up menu that comes up.    Repeat the above process for each of the 8 files listed above until you have them all removed.  

Alternate way:   Click on START then FIND then FILES OR FOLDERS.   Type the file name you are looking for in the NAMED field (For example, to find the first file you would type MSKernel32.vbs in the NAMED Field).   Make sure that you have MY COMPUTER in the LOOK IN field.  If you don't have MY COMPUTER in the LOOK IN field, click on the down arrow to the right of the LOOK IN field and pick MY COMPUTER from the list.  Then, hit the button FIND NOW.   If you are infected, the file name will come back as found and list a location for the file.   DOUBLE CHECK that the file is in the place that the listing shows that it should be.   For example, MSKERNEL32.VBS should be in the windows\system directory.   If this matches up, the RIGHT CLICK ONCE on the file name and choose DELETE from the pop up menu with your LEFT MOUSE BUTTON.    Repeat the process for each file name until done.   

To double check that the virus has been removed, repeat the alternate way listed above and after hitting find, it should come back with no exact matches for the files listed above.

Final way:   You can go to this webpage and follow their instructions to download a program that will remove the virus and all associated files. 

Comments:

This virus can be removed for the standard computer service fee at Computer Partners in Greenup, IL (217-923-5115 Mon-Fri 9 am-5 pm)  if you would rather have someone else remove the virus.   There will be a fee to do this work.

Did you get our Spring Newsletter?   On the back page of the newsletter in the section under Security, we describe the potential security problem with Outlook Express.   If you have done the fix described on the newsletter, you are protected from this type of virus.    If you didn't get our Spring Newsletter (mailed April 21st), please call 217-923-5115 and we'll send you out a copy of it and confirm your mailing address for future mailings.  If you aren't infected, and you use Microsoft Outlook Express or Microsoft Outlook, please take the steps described in the newsletter to prevent any problems in the future.

Want to read more about it?  Check out this page

Want to put another e-mail program on your computer? You can pop in our Easy Internet CD disk and follow the instruction book and install EUDORA e-mail program.   After you install this, you'll have to go through the Internet Configuration Step where you pick your town and phone number.   This will set up Eudora to get your e-mail.    You'll still need to disable your Outlook Express (or Outlook) program by opening it up, then click on TOOLS then ACCOUNTS and choose the tab labeled MAIL.   Remove any of the mail accounts that are in this section and your Outlook Express (or Outlook) will not be able to send or receive e-mail and you will not be affected by the security problems described here.

Need to change your homepage back to Cumberland Internet?  Read these instructions

Questions?   E-mail suggestions@rr1.net