The "LOVE LETTER FOR YOU" VIRUS

1. Upon receipt of any e-mail with the words 'I love you' in it, you should delete the e-mail immediately, also the e-mail must be deleted from the 'deleted items' folder in your mail program to ensure that the virus does not a) cause any harm to your system and b) spread to other systems.

2. If the virus has already been activated by attempting to access the attachment, then it will have created a minimum of 3000+ items on your hard drive. To remedy this, the following must be done:

a) All traces of the e-mail must be removed from your e-mail program - see step 1.

b) You must search your system for all files with the .vbs extension, best done by using a wildcard in the search field such as *.vbs. If you have a version of Windows that is 95 or more recent, then use the 'find' facility in the 'tools' menu and put the *.vbs text string in the field 'named'. Upon finding these files, (expect 3000+), you must delete them, the virus will have converted random files on your system to the '.vbs' type, there is no procedure for recovering these files. Also, do a search in the 'named' field and input the text string 'LOVE-LETTER', this should result in one file being found, which will have a .htm extension. This file is the one which attempts to download the trojan horse part of the virus to your system if activated. DO NOT ACTIVATE, as this will result in all your passwords etc. being submitted to select parts of the internet. Instead DELETE it.

c) If you have any mIRC programs on your system, then delete the script.ini file and replace it with a clean version, as otherwise you would infect other mIRC users if you attempted to use mIRC.

3. IF you have already downloaded the Trojan Horse program, then do a search for WIN-BUGSFIX.exe - if it is on your system, then delete it.

© J. Banks 4^th May 2000.

Note: if you have the virus on your computer don't leave it running as the virus will probably continue to replicate itself and can overload (and thus crash) your hard drive. Don't open your mail program at all [or you'll be sending out the virus to all your contacts], don't open your browser on line as you may be giving open access to your system, and don't use IRC (Internet Relay Chat) or you risk sending it to everyone else on IRC.

Don't turn on the power to your computer until you're ready to start tackling the virus using the above steps.

This information is given in good faith, we don't guarantee it will work for you but it did for us.

E.O.E.

***** the address of this page is http://www.happychild.org.uk/xvirus.htm
at the website of Project HappyChild, linking children all across the world *****