November 20, 2009

How to remove I Love You Virus

There are so many virus and of different names that the virus creators seems to run short of the names. “I Love You virus” is a strange name used by its creator. Requested by one of our viewers, here are the steps to remove the virus.

But before discussing the solution, let’s see the details of this virus. The “I Love you” virus also known as the “Love” virus and spreads mainly via emails. The name is believed to originate from the subject of the mails but there have been some other modifications in the name like “Mother’s Day” and “Joke” virus.

This is the format of the e-mail that contains this virus.

Sender: Someone a user know
Subject: ILOVEYOU
Body: Kindly check the attached LOVELETTER coming from me.
Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs

The default settings of Windows don’t display the last extension and this is where a user thinks this virus as a normal text document.

Steps to remove Love Virus:

1. Kill any process containing “love” from the task manager; also remove it from the computer’s startup list (run msconfig in the run box).

2. Search your hard disk for following entries:

LOVE-LETTER-FOR-YOU.TXT.vbs
LOVE-LETTER-FOR-YOU.HTM
MSKernel32.vbs
Win32DLL.vbs
WIN-BUGSFIX.exe

Permanently delete the files found from above search result.

3. Run regedit in the Run box and delete the following entries, if any:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Win 32DLL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX HKEY_LOCAL_MACHINE\Software \Microsoft\Windows\CurrentVersion\Run\WinFAT32=WinFAT32.EXE

This will restore the settings back to the original after rebooting the computer.

4. You may also like to Change the default URL in the registry to:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page “http://www.msn.com” or any of your choice.

Related Articles

1.how to remove sysdate.exe

2.How to remove I Love You Virus

3.How to Remove csrcs.exe or csrsc.exe Virus

4.How to remove regsvr.exe

5.Drives are not opening by double click. What to do ?

6.Signs of Intenet browser hijacker infection

7.Spyware threats and removal instructions

8.How to remove Autorun.inf

9. How to enable task manager

No comments:

Post a Comment