LOVELETTER virus fix (partial)

[jharrison]

To Stop LOVE-LETTER-FOR-YOU


Go to Task Manager
stop process WSCRIPT.exe

delete these files wherever you find them:
LOVE-LETTER*.*
MSKernel32.vbs
Win32DLL.vbs
WIN-BUGSFIX.exe (probably not there)

------------
search for all *.vbs files created today on all drives
Any that are 11K are definitely infected.
All .vbs and .vbe files have probably been overwritten and lost.

------------
Anybody with MIRC has had a script.ini file created in default MIRC directory with virus.

------------
Will need to fix registry entries as well,

Delete these registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run\MSKernel32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunServices\Win32DLL


more to come?....
--------

Home/Start page for Inet explorer changed, looks like no harm because site it points to has been taken down.
--------

Rebooting will not cure!