A new e-mail worm is rapidly spreading across the globe affecting users of
Microsoft Windows running Microsoft Outlook. The ILOVEYOU worm (a.ka.,
VBS.LoveLetter.A) infects VBScripts, mIRC users and files on your hard drive
(namely .jpg and .mp3 files). Here are basic steps you can take to avoid
infection, and what to do if you are already infected by the worm that gives
love a bad name
The worm makes changes to the Windows registry and copies the Outlook
address book and e-mails itself to all of your contacts. (Previously,
viruses such as Melissa and its variants only chose the first 50 addresses.)
This new worm has been overloading e-mail servers around the world. Luckily,
users of Mac OS, Linux, and other OSes are not affected. However, anyone can
pass it on by forwarding the infected e-mail.
ILOVEYOU arrives as e-mail with the subject line “I Love You” and an
attachment named “Love-Letter-For-You.txt.vbs.” Opening the attachment
infects your computer. The infection first scans your PC’s memory for
passwords, which are sent to a Web site in the Philippines that has since
been shut down. The infection then replicates itself to everyone in your
Outlook address book. Finally, the infection corrupts files ending with
.vbs, .vbe, .js, .css, .wsh, .sct, .hta, .jpg, .jpeg, .mp2, .mp3.
EASY STEPS FOR PREVENTION
One, do not open e-mail with the subject line “ILOVEYOU,” no matter who sent
it. This is the ILoveYou virus and is very destructive. If you receive the
ILOVEYOU message, delete it from your system immediately. Do the same with
mail that has the subject line “FW: JOKE” and contains an attachment called
“Very Funny.vbs.” This is a variant of ILOVEYOU.
Two, if you do receive it, delete the message and contact the person you
received the message from so he can eradicate the worm. A rule to live by
is: Never open attachments included with e-mail unless it goes through an
anti-virus tool scan first. Also, never open attachments from unknown
addresses; these are often carriers of viruses and worms.
Three, download an anti-virus tool to screen and eradicate the virus. For
ongoing protection, install an anti-virus program to prevent viruses from
infecting your system. A good anti-virus program will scan all vulnerable
parts of your system quietly in the background and detect, repair, and
delete known viruses; it will even alert you to virus-like activity in case
an unknown virus creeps on to your system. Try one of ZDNet Downloads’
top-rated anti-virus programs, or check out ZDNet’s Anti-virus ABCs toolkit
for specific recommendations.
In general, always have anti-virus software on your system. Update it at
least once a month with the latest virus definitions (signatures), so that
your anti-virus program can detect the newest viruses. Four, it is strongly
recommended that if you do not use Visual Basic scripting in the course of
your work day, you should turn this option off. To do so:
Click on Settings
Click on Control Panel
Click on Add/Remove
Click on the Windows Setup tab
Click on Accessories to obtain the details
Uncheck Windows Scripting Host if it is checked
Click “OK” to save any changes
IF YOU ARE INFECTED …
You can download one anti-virus update that will eradicate ILOVEYOU from
infected PCs here:
http://hotfiles.zdnet.com/cgi-bin/texis/swlib/hotfiles/info.html?
f
code=00181
N&b=help
All major anti-virus software companies have released updates allowing their
software to detect and defend against the virus. The latest virus
definitions are available for:
Norton AntiVirus 4.0, 5.0 and 2000
Norton AntiVirus 2.0 through 4.0 (DOS, Win3.x)
Norton AntiVirus for NetWare
McAfee VirusScan/Dr. Solomon
Additionally, if your PC is infected, delete the following files from your
infected system:
MSKernel32.vbs in the Windows System directory
Win32DLL.vbs in the Windows directory
LOVE-LETTER-FOR-YOU. TXT.vbs in the Windows System
WinFAT32.EXE in the Internet download directory
script.ini in the mIRC directory
Good Luck!
