Posted: 5 May, 2000

The Love bug bites hard:
Information and fixes

You can protect yourself against the so-called Love Bug -- an virus called VBS.LoveLetter or VBS.LoveLetter.A spread by e-mail-- by downloading the latest virus signatures from the maker of your anti-virus software.

According to a Symantec press release, reports regarding this worm (a virus that spreads through a network like the Internet) appeared early on May 4, 2000 GMT. It appears to have originated from the Asia Pacific region, possible the Philippines. Distribution of the virus is widespread and hundreds of thousands of machines are reported infected.

Since the initial infection, both McAfee and Symantec have posted cures to the virus on their Web sites.

Symantec Norton AntiVirus: http://www.symantec.com
McAfee Online Virus Cleaner: McAfee Virus Clinic

If you don't have an anti-virus program, you can download and install one from Beyond at: 

http://www.beyond.com/AF46011/support/antivirus.htm

Prices are about $20 US ($30 Canadian).

You might try free utilities and services below to protect from future bugs and to clean up an exisiting infection:

• Script Logic - a free downloadable scripted cleaner
• Tech24 -- get a live person to help you clean your system
  

The VBS.LoveLetter.A is an Internet worm that uses Microsoft Outlook to e-mail itself as an attachment. The subject line of the e-mail reads "ILOVEYOU," with the attachment titled "Love-Letter-For-You.TXT.vbs." 

Once the attachment is opened, the virus replicates and sends an e-mail to all e-mail addresses listed in the address book. The virus also spreads itself via Internet Relay Chat (IRC) and infects files on local and remote drives including files with extensions vbs, vbe, js, sje, css, wsh, sct, hta, jpg, jpeg, mp3, mp2. 

Users should be careful when opening e-mails with this subject, even if the e-mail is from a friend or colleague, as that is how the virus spreads. 


"I LOVE YOU" VIRUS ELIMINATION:

Do not open e-mail with the subject "ILOVEYOU." If you receive the ILOVEYOU message, delete it immediately. 

If you do receive it, delete it and contact the person you got it from so they can delete it from their computer. 

Download an anti-virus software package or update the one you have to stop the virus in its tracks or to kill it off on an infected system. Always run anti-virus software on your computer and keep it updated. 

Cyberwalker recommends that you do not use Visual Basic scripting on your computer. Here's how to turn it off:

Click on START then Settings, then Control Panel, then click on Add/Remove Programs, then click on the Windows Setup tab, next, double click on Accessories to get the details, then uncheck Windows Scripting Host if it is checked. Finally, click "ok".

HOW THE "I LOVE YOU" VIRUS WORKS: 

When the attachment that comes with the virus is opened (with a double click) it installs in three places in the Windows folder (C:\Windows). 

It also changes the default Internet Explorer home page. The next time the computer is restarted the virus opens Internet Explorer and downloads a file from one of four Web addresses. 

It then emails itself to all contacts in the Outlook address book and overwrites and appends "vbs" to all files with the following extensions. .vbs .vbe .css .sct .jpeg .mp3 .jse .wsh .hta .jpg .mp2 

Even if you don't use Microsoft Outlook on your computer, the "ILoveYou" worm can still do damage to your PC. The worm will take all of the JPEG picture files stored on a computer and replace them with
worm-infected files. 

A file named grandma.jpg, for example, will be replaced by a file called grandma.jpg.vbs which would contain a copy of the worm. The worm will also create a copy of itself for each MP3 and MP2 music files on a PC. The original MP3 or MP2 files will still be on the hard drive, but they will be hidden.

The Love Bug also modifies the mIRC chat program to infect other mIRC users in IRC-based chat rooms.