Re: I Love You.. Repair Program

[Dan_Schrader () TRENDMICRO COM (Dan Schrader)]

This program appears not to fix a few problems the bug leaves behind.

1.  Of course it cannot restore the "vbs", "vbe", "js", "jse", "css", "wsh",
"sct", "hta", "jpg", "jpeg" files that were overwritten (can anyone spell,
"backup" ;))

2.  MP2 and MP3 files can be restored - all the bug did was change the
system attribute to hidden.  Change the attribute back and your Mp files are
back.

3.  For each email the virus sends out, it inserts the email recipient's
name as a registry entry to HKEY_CURRENT_USER\Software\Microsoft\WAB\. The
virus uses this record to make sure it sends email only once from one
infected system to each recipient in the Outlook Address book.  Since the
virus creates a registry entry for each email recipient it sends to, the
registry file maybe be completely full if the Outlook Address book contains
a many address entries. This would make the Windows system unable to reboot.
These added registry entries need to be cleaned up.

Dan Schrader
Trend Micro
http://www.antivirus.com

-----Original Message-----
From: James Wilkins [mailto:james () TRAFFIC CO UK]
Sent: Thursday, May 04, 2000 9:03 AM
To: VULN-DEV () SECURITYFOCUS COM
Subject: I Love You.. Repair Program

Hi Guys,

Please find enclosed a program that reverses all the effects of that nasty
'I LOVE YOU' Virus

It,

Kills the Windows Scripting Engine that is running
Removes the Registry entries it places in the CURRENTVERSION\RUN* Keys
Removes all *.vbs files that are copys of the script (checks the first few
lines to ensure they match)

Hope this helps some of you out there, who like us have a 100+ user base
that all decided they would open the email.

Regards

James


--
Mr James Wilkins | Systems Administrator | Traffic Interactive Limited
020 7616 9041      | james () traffic co uk     | http://www.traffic.co.uk
----------------------------------------------------------------------------
-------------------------
"Never argue with an idiot. He will take you down to his level, and
beat you with experience."