It's an old but true answer: diligently update the virus definitions in your
antivirus software, and stay wary of attachments to e-mail, antivirus vendors
Still Fighting Variants
The Scan and Deliver service from Symantec (http://www.symantec.com) welcomes
submissions of suspicious files. The antivirus research center will check them
for variants of the original VBS. LoveLetter.A.Virus, says Patrick Martin,
So far, most variants to the Love Letter bug involve simple changes to the
subject line or spaces in the code, Martin says. "If they change enough of the
Visual Basic script, you could look at it as a new worm."
To fight ongoing variants, Symantec's software checks for certain code that
stays consistent in the worm's script, Martin says.
To be safe, Martin suggests you delete attachments with .vbs extensions and be
cautious of those with one of the other five extensions in Windows scripting
host: JS, JSE, VBE, WSF, and WSH. You can download the latest data definitions
through Norton Antivirus LiveUpdate.
Update-Seekers Clog Sites
Logging on to update your definitions is sound advice, but not always easy.
Antivirus vendors Symantec, Network Associates, (http://www.mcafee.com) Computer
Associates, (http://www.cai.com) and others posted updates to detect the Love
Letter bug. But getting through was a challenge. Symantec reports nearly 16
times the normal traffic to its LiveUpdate servers during the Love Bug's height
You can also find the Norton update at Symantecstore.com and
digitalriver.com/symantec. And other sites, including PC World.com, have posted
several detection programs.
Network Associates has measured more than one million corporate downloads of its
McAfee VirusScan since the Love Letter started circulating, says Gene Hodges,
president and chief operating officer of Network Associates' McAfee division.
The virus-fighters aren't the only ones with clogged networks. The Love Letter
bug shares its payload by infiltrating your Outlook address book and sending out
more Love Letters. Consequently, victim companies find their e-mail servers
Are Your JPEGs History?
If you didn't already have antivirus software in place when the Love Bug bit,
some utilities can still help. Both CarbonMedia (www.carbonmedia.com) and Script
Logic (www.scriptlogic.com/downloads/sl/lovebug.zip) offer cleaning scripts that
will try to remove the infected registry entries, .vbs files, and virus
In addition to clogging e-mail networks, the Love Letter virus infects the
graphics files with VBS extensions on your system. It destroys your JPEG files.
However, MP3 and MP2 files fare better; they're still on the hard drive, just
hidden in the directory, Symantec's Martin says. Those can be recovered fairly
easily with utilities that restore deleted files.
Back Up and Prepare
Once you've recovered, it's time to reassess your backup habits and take
precautions. Countless support sites and recovery services offer tools to better
prepare for future attacks.
Adaptec (http://www.goback.com) is offering a free 30-day trial of its GoBack
system recovery software. GoBack tracks changes on your hard disk and maintains
them in a queue, says Jean-Eric Garnier, Adaptec's director of marketing for
productivity protection products.
"At any time, you can revert the hard disk to the way it was before you lost
that document, were hit by that virus, or installed software," Garnier says.
Of course, if you didn't have GoBack when I Love You struck, it won't recover
anything the bug destroyed. But it could help with the next hateful mail, even
if it's disguised as a love note.