Vulnerability Development mailing list archives

Re: I love you - Manual Remove


From: guy () GIZMOZ COM (Guy Cohen)
Date: Thu, 4 May 2000 23:53:38 +0300


Small correction about my previos mail concerning the key:
"HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout"
It pt the value 0, not 1, there.

Krzysztof Zagrodzki <kzagrodzki () UNIZETO PL> wrote:
If you want remove it:

From key
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"

Remove:

"MSKernel32.vbs"
"WIN-BUGSFIX.exe"

From key:

"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices"

Remove:

"Win32DLL.vbs"

and change in key:

"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page"

must be:

"about:blank"

Restart system and remove files:

"MSKernel32.vbs"
"Win32DLL.vbs"
"LOVE-LETTER-FOR-YOU.TXT.vbs"
"WIN-BUGSFIX.exe"

This metod come from mks.com.pl



Krzysztof Zagrodzki

UNIZETO Sp. z o.o.                            
ul. Krolowej Korony Polskiej 21-23
70-486 Szczecin, Poland
cent.+48 91 4801201
tel.   +48 91 4801288          http://www.unizeto.pl
fax.  +48 91 4801220          e-mail: kzagrodzki () unizeto pl


Current thread: