Ryan Yagatich ryagatich at
Thu May 4 17:22:30 GMT 2000

we've been hit by this as well. so has Corporate Bank 1 and some others. 

here's how to remove it.

delete from outlook.

run registry editor by typing regedit at the run menu.

goto "HKLM\Software\Microsoft\Windows\Current Version\Run" and delete the: MSKernel32.vbs link.
goto "HKLM\Software\Microsoft\Windows\Current Version\Run Services" and delete the: Win32DLL.vbs link

right click on internet explorer, goto properties and change your homepage back the way it was.

goto start, find *.vbs on ALL drives, it will over write ALL .mp3, .jpg, .jpeg, .mp2, .vbe, .vbs, .js, .jse, .css, .wsh, .sct, .hta with itself, and append .vbs to the end of it.

then it will create a temporary web-page that will say "to view this document, please click on the button to view Active-X"

if you have MIRC, it will modify your scripts, so when a person joins, except self, it will send that .htm document to the other people on the channel. so you want to remove them as well. yes, it does say that MIRC will never run again, but it's a lie.

then it goes to outlook. finds all users on your outlook contact list, and sends itself to each user there with the subject in which you have seen.


>-----Original Message-----
>From: samba-ntdom at [mailto:samba-ntdom at]On Behalf Of
>Kells Kearney
>Sent: Thursday, May 04, 2000 1:03 PM
>To: Multiple recipients of list SAMBA-NTDOM
>Subject: Re: ILOVEYOU
>  Please DO NOT RUN THIS!!!!
>  This is a trojan horse that goes through your address list and 
>then propagates
>itself.  There is a more detailed explanation of exactly the 
>damage that it does
>that I can provide to interested parties.
>  The office next to us has been struck by it, as well as at least 
>one other
>office in the area.
>"Miller, Teddy" wrote:
>> kindly check the attached LOVELETTER coming from me.
>>                                   Name: LOVE-LETTER-FOR-YOU.TXT.vbs
>>    LOVE-LETTER-FOR-YOU.TXT.vbs    Type: unspecified type 
>>                               Encoding: quoted-printable

More information about the samba-ntdom mailing list