Manual Disinfection of LOVE LETTER

Erasing the Worm's files.

Search all the .vbs files on all drives and erase them. These files all contain a copy of the worm.

Find the LOVE-LETTER-FOR-YOU.HTM and erase it if it exists.

Find the WIN-BUGSFIX.exe and the WinFAT32.exe files. Erase them if they exist.
These files will only be present if you were infected at an early stage and the worm still could access its websites.

Fix the Registry with Regedit

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
Delete the MSKernel32 et WIN-BUGSFIX entries.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\
Delete the Win32DLL entry.

Eventual Recovery of your MP3

If you have lost MP3 (or MP2) files, open a DOS session and execute the following command

attrib -h *.* /s

in the base directory that contained your files. They will reappear.

MIRC Reconfiguration

Erase the script.ini file that is present in the MIRC directory.


DataRescue 45 quai de la Dérivation 4020 Liège (Belgium) tel 32-4-3446510 fax 32-4-3446514 Please send us your questions or comments.