[ILUG] Info on virus

[Roy White]

Hey Guys,

	Here's some info I got from another mailing list, good luck
-------------------
I am submitted the virus to Symantec, who will work on it immediately. 
In the meantime, here is what I have to able to discover about the virus:
It will attempt to replicate itself via email to everyone in the GAL (not
nice). This takes sometime, and processor usage will be high. 
To manually remove it, perform the following: 
Use Task manager to kill off wscript.exe (This is the system file that runs
all vb script files) 
Delete the following files: 
· C:\Temp\LOVE-LETTER-FOR-YOU.TXT.vbs
· C:\Temp\LOVE-LETTER-FOR-YOU.TXT1.vbs
· C:\WINNT\WIN32DLL.vbs
· C:\WINNT\System32\LOVE-LETTER-FOR-YOU.TXT.vbs
· C:\WINNT\System32\MSKERNEL32.vbs
· Any instances of WINS-BUGFIX.exe on the system 
Remove the following registry entries: 
· HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MSKERNEL32
· HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\WIN32DLL
· HKCU\Software\Microsoft\Internet Explorer\Main\Start Page 
Reboot the system 
Delete all emails with the subject ILOVEYOU
----------------------

Regards

	Royster

Roy White
IT Manager
Information Mosaic Ltd.
Clifton Hall
Fitzwilliam St. Lwr.
Ph:+35316626900
Fax:+35316626901
VM:+353872228699