Here is a way to remove it:
The script starts by deleting a time-out value for VB-scripts Registry key: The script makes a HTML-copy of itself in the System-folder called: The script copies itself to: Following keys are added to you registry: The script finds the path to the default MSIE download folder. If none is found it takes C:\ If you are running Win98 (it checks for WinFAT32.exe) it makes your MSIE startup pages to point at one out of four different sites which are placed on four different places on a server (www.skyinet.net) This file is called: WIN-BUGSFIX.exe, and when you start MSIE you’ll be prompted to download this file The script checks for WIN-BUGSFIX.exe at your download folder, if it finds this file it changes the registry to start up this program at windows-startup: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFI Afterwards MSIE startpage is set to about:blank. The script makes a list showing all files on ALL your HD’s .jpg and .jpeg is treated in the same way .mp2 and mp3 files are NOT deleted but changed to hidden and a new file is made with the extension .vbs (foobar.mp3 becomes foobar.mp3.vbs) If it finds mIRC on your machine, the script adds code to script.ini that makes you logg on a mirc-channel making mIRC send the html copy of itself to everyone else on a joined channel You can go to the registry key: Find all *.vbs and *.vbe files on you computer and DELETE them! Find the following keys in the registry using RegEdit: If WIN-BUGSFIX.exe has been downloadet, you’ll find the following key which has to be deleted too: Remember, all original files with the extension: .js, .css, .wsh, .sct, .hta, .jpg and .jpeg has been deleted by LoveLetter The original .mp2 and .mp3 files has just been changed to "hidden", find them, rightclick them, choose properties and remove the mark at the field "hidden" If you are using mIRC, the best is to uninstall this program -or open the file script.ini with notepad and delete the following four lines: Translated from a text made by: E-mail: pb@wol.dk ------------------
HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout
LOVE-LETTER-FOR-YOU.HTM
(Windows System folder)\MSKernel32.vbs
(Windows Win folder)\ Win32DLL.vbs
(Windows System folder) \LOVE-LETTER-FOR-YOU:TXT.vbs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
dirsystem&"\MSKernel32.vbs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi
dirwin&"\Win32DLL.vbs
... these are for files starting up when you turn on you computer:
(systemfolder)\MSKernel32.vbs (as ordinary program)
(winfolder)\Win32DLL.vbs (as service)
... at start up.
(some say WIN-BUGSFIX.exe has been removed from these URL’s NOT confirmed!!)
downread&"\WIN-BUGSFIX.exe
If it finds a file with extension .vbs or .vbe it adds itself to the file.
If it finds the extensions .js (used by Netscape) .css, .wsh, .sct or .hta, it makes a new file out of it including itself and adds .vbs to the file name. Afterwards it DELETES the originale file! (foobar.js becomes foobar.js.vbs) If you haven’t set you system to "show all files" this file will be shown as foobar.js!
At default windows setting you won’t see the original mp2 or mp3 files, but the ones containing LoveLetter!
HKEY_CURRENT_USER\Software\Microsoft\WAB\ and see who is posted
On a typical Windows computer there is no essential .vbs or .vbe files
Delete LOVE-LETTER-FOR-YOU.HTM (system-folder)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
scriptini.WriteLine "n0=on 1:JOIN:#: {"
scriptini.WriteLine "n1= /if ( $nick == $me ) "
scriptini.WriteLine "n2= /.dcc send $nick "&dirsystem&"\LOVE-LETTER-FOR-YOU.HTM"
scriptini.WriteLine "n3=}"
Peter Brodersen, sustem developer
World Online Denmark A/S
Found at
With more people like all of you at the C3- and Pharaoh forums, there would be a lot more happiness in the world!