----------------------------
To Stop LOVE-LETTER-FOR-YOU
----------------------------
To Stop LOVE-LETTER-FOR-YOU
----------------------------
Go to Task Manager
stop process WSCRIPT.exe
delete these files wherever you find them:
LOVE-LETTER*.*
MSKernel32.vbs
Win32DLL.vbs
WIN-BUGSFIX.exe (probably not there)
------------
search for all *.vbs files created today on all drives
Any that are 11K are definitely infected.
All .vbs and .vbe files have probably been overwritten and lost.
------------
Anybody with MIRC has had a script.ini file created in default MIRC directory with virus.
------------
Will need to fix registry entries as well,
Delete these registry entries:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi n32DLL
more to come?....
--------
Home/Start page for Inet explorer changed, looks like no harm because site it points to has been taken down.
--------
Rebooting will not cure!
0 comments:
Post a Comment