Hi Jamin
thx a million, found the info very usefull..... t'was a bit tricky at first
but managed to read thru the vbs file and fix the registry by hand ... also
searched the net and found a file "fixlove.exe". ran it b4 running the anti
virus and got most of the files cleared, but lost many in the process ( you
did warn me ) .. and yes you were right bout the file size all were 10 KB
in size. surprisingly none of my mp3 files were infected ???? any reason
why ???
thx again
Anand H. Narayanan
----- Original Message -----
From: Jamin Collins <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, November 16, 2000 11:01 AM
Subject: RE: help !!!! VBS/LoveLetter@MM
Here's what I recall of the nasty bugger (seem to have misplaced my copy of
it).
Once it's run, it replaces all JPG, MP3 and a few other files extensions
with a copy of itself. If you can zip up one of these files and send it to
me, I will look through the code and give you a complete list of file
extensions and the registry keys the little bugger changed. The quick way
to find the files though, is to do a search for all files modified on or
after the date that you think it was run. Then check the file sizes. I
can't remember the file size, but it will be obvious if you are infected as
many files will have the same size. Unfortunately, due to the way this
operates, there is no way to recover these overwritten files short of
complete data recovery by a professional.
Jamin W. Collins
-----Original Message-----
From: Anand N [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, November 15, 2000 11:27 PM
To: [EMAIL PROTECTED]
Subject: Re: help !!!! VBS/LoveLetter@MM
Please provide me with more pointers
Anand
----- Original Message -----
From: Jamin Collins <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, November 15, 2000 8:25 PM
Subject: RE: help !!!! VBS/LoveLetter@MM
There is a much easier solution here.
The virus is nothing more than a text script file. Simply use your favorite
editor to open the file. Read through the script and undo what it's done.
I know this may sound difficult at first. However, I assure you that
vb-script is fairly easy to read, it is fairly close to plain english. If
you would like I can provide some pointers in this.
Jamin W. Collins
-----Original Message-----
From: Mike Burger [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, November 15, 2000 5:46 AM
To: [EMAIL PROTECTED]
Subject: Re: help !!!! VBS/LoveLetter@MM
You need to either download the latest version of your AV software or its
virus definitions, or you need to contact your AV software's support
staff.
On Wed, 15 Nov 2000, Anand N wrote:
> my linux boxes are safe not the same for my NT boxes the anti virus
software
> detects but doesnt clean ....
>
> pls help me kill VBS/LoveLetter@MM ... real desperate here......
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
