vbs.loveletter fix - symantec.com
vbs.loveletter fix - symantec.com
united states
norton|
business|
partners|
store|
about symantec
symantec.com
>
security response
> vbs.loveletter fix
vbs.loveletter fix
download removal tool | printer friendly page
summary
updated: august 24, 2005 12:00:00 am
type: removal information
the vbs.loveletter fix tool removes the changes that were made to a computer by all known versions of the vbs.loveletter worm except vbs.loveletter.ca, vbs.loveletter.bj, vbs.loveletter.bm and vbs.loveletter.as.
caution: before you run the tool, you must update to the most recent virus definitions and run a full system scan, making sure that norton antivirus (nav) is set to scan all files. if you run the tool before scanning your system, you may see warnings that indicate that files have been infected with loveletter. if you see any such warning, choose to delete the files.
notes:
this tool will have limited effectiveness if you have been infected with vbs.newlove.a. this variant of loveletter destroys all files on the system that are not in use. therefore an infected system will most likely be unstable.
if you are running this tool on windows nt or windows 2000, you must have administrator-level privileges.
when the tool has finished running, you will see a message indicating whether or not the computer was infected by vbs.loveletter.
if you are an administrator, and you want to run the tool without displaying the information dialog box, run the tool with the /auto command line switch; for example, c:\windows\desktop\fixlove.exe /auto
to obtain and run the tool:
go to http://www.symantec.com/avcenter/fixlove.exe.
download the file to your windows desktop.
double-click the fixlove.exe file to start the repair tool.
click remove! to begin the process, and allow the tool to run.
the digital signature
fixlove.exe is digitally signed. symantec recommends that you only use copies of fixlove.exe that have been downloaded directly from the sarc download site. to check the authenticity of the digital signature, follow these steps:
go to http://www.wmsoftware.com/free.htm
download and save the chktrust.exe file to the same folder where you saved fixlove.exe.
click start, point to programs, and click ms-dos prompt.
change to the folder where fixlove.exe and chktrust.exe are stored, and then type:
chktrust -i fixlove.exe
for example:
cdcd download
chktrust -i fixlove.exe
press enter after typing each command.
if the digital signature is valid, you will see the following:
do you want to install and run "fixlove.exe" signed on 5/11/2000 3:19 pm and distributed by symantec corporation.
notes:
the date and time that are displayed in this dialog will be adjusted to your time zone if your computer is not set to the pacific time zone.
if you are using daylight saving time, the time that is displayed will be exactly one hour earlier.
if this dialog does not appear or the date and time are not correctly adjusted for your time zone, do not use your copy of fixlove.exe. it is not from symantec.
click yes to close the dialog box.
type exit and then press enter. this will close the ms-dos session.
what the tool does
the vbs.loveletter tool does the following:
deletes the win32dll.vbs file from the \windows folder.
deletes the following files from the \windows\system folder:
mskernel32.vbs
love-letter-for-you.txt.vbs
love-letter-for-you.htm
winfat32.exe
win-bugsfix.exe
funny love.vbs
funny love.htm
removes winfat32.exe, win-bugsfix.exe, and all .vbs entries from the following registry keys:
hkey_local_machine\software\microsoftwindows\currentversion\run
hkey_local_machine\software\microsoftwindows\currentversion\runservices
hkey_users\username\software\microsoftwindows\currentversion\run (this is done for all users.)
restores the timeout value for the windows scripting host key for all users, if present:
hkey_users\username\software\microsoft\windows scripting host\settings
sets the starting page for internet explorer in the registry key:
hkey_local_machine\software\microsoft\internet explorer\main\start page
to http:/ /www.symantec.com/avcenter/repair_instruct.html.
removes all dword values from the registry key:
hkey_users\username\software\microsoft\wab
except for ldap connection timeout and server id. (this is done for all users.)
searches all local hard drives for hidden .mp3 and .mp2 files, and removes the hidden attribute.
searches all local hard drives for loveletter script.ini files. if found, the script.ini file will be overwritten with a blank file that contains just one line:
[script]
top things to do
see all viruses & risks
secure your email
browse the web safely
read the security response weblogs
scan your computer for malware
search threats
search by nameexample: w32.beagle.ag@mm
©1995 - 2007 symantec corporation
site map |
legal notices |
privacy policy |
|
contact us |
global sites |
license agreements
Acceuil
suivante
vbs.loveletter fix - symantec.com If It Works, Don't Fix It! Vasectomy Information Home Page Abena Frantex Abri Fix - Incontinence urinaire Nukefix, To Fix the Nuclear Weapons Problem Congress Pushes 'Band-Aid Fix' to Gas Price Woes, Analyst Says ... À propos de votre fix « Le Blogue d’Ironica Finding a Fix The new urgency to fix online privacy Perspectives CNET News.com FIX définition FIX Eye Fix Photos: Photo Restoration and Retouching A race to fix a 30-year-old 'solution' csmonitor.com We Can Fix That with Data [Profil de Fix] OverBlog - Le blog des blogs Simple "ntldr is missing" fix with boot floppy, CD-R, or USB flash Fix290 How to Fix a Scratched CD - wikiHow PINBALL: Pinball Repair Guides. Collector buys pinball, arcade ... Apple Releases Fix For iMacs That Freeze Up -- Apple ... Macrovision: Updating the Macrovision SECDRV.SYS Driver Can Architects Fix Construction’s “Busted Budgets”? News ... Opinion Fix public education Seattle Times Newspaper Tricia Fix Originals. Florida born fashion designer The Hotfix - Vista SP1, XP SP3, IE8, Home Server, and more! - Home Rob Galbraith DPI: Canon EOS-1D Mark III autofocus fix may be two ... OpenBSD 3.4 errata Berkshire Computer Repairs And Servicing - 1-Fix Computer Services The Art of Colin Fix The Daily Fix - WSJ.com The Right Way To Fix Inaccurate Wikipedia Articles M·A·C Cosmetics Studio Fix Powder Plus Foundation Blogger Buzz: A Layout Solution fix. The American Heritage® Dictionary of the English Language ... script-fix -- Screenplay Database fix - Synonyms from Thesaurus.com Prototype JavaScript framework: Prototype 1.5.1.1 bug fix release Outlook-QuoteFix - Home Proposal to fix Pacific with 'urea' dump - Telegraph Harley-Davidson Maintenance - Do It Yourself DVDs The library fix Salon.com Angry-Fly.com: Fix for MySQL on Leopard Toilet Repair: Leaks, Tanks and Bowls Toilet Repair Fix a ... Advanced Registry Fix – Registry Repair Fix Slow Computer: spyware, trojan horse, virus removals edgeblog » Daylight Saving Time - Windows Mobile Fix Paul Fix Quotes - The Quotations Page Paroles Fix You - Coldplay - Musique Ados.fr Hex blog: Windows WMF Metafile Vulnerability HotFix Amazon.com: FLIP: How to Find, Fix, and Sell Houses for Profit ... MG LSP-Fix 1.1 Researcher releases unofficial IE fix for URI bug The Register Idées fix(e)s - Skitour [Groupe fr-comp-reseaux-ip] : Dans quel connexion mettre mon IP ... Tourism-Site-Fix Vril's Transparent PNG Fix for WordPress The Joy of Flex » Blog Archive » More on fix to Leopard file ... zieh fix フィックスレコード公式サイト fix: Definition, Synonyms and Much More from Answers.com Microsoft Watch - Server - Microsoft's Fix for the Middle Child ... The Knicks Fix Quick Fix Meals with Robin Miller - Show List A to Z - TV - Food ...