TranceAddict Forums (www.tranceaddict.com/forums)
- Chill Out Room
-- Love Letter Virus infected my comp....HELP!!!
Love Letter Virus infected my comp....HELP!!!
K....heres the story...was downloading an mp3 from Kazaaa (little did i realize it had a vbs extension) then when i tried plain it, nothin happened...so i deleted the file....then, next thing i know, my computer starts workin on something...found it extremeley strange... so i press Ctrl+Alt+Del and close WScript which i found was suspiciously running.....i forgot to stop that when i started up my comp today...... and boom....
i found all my mp3s were changed to 11kb vbs files...but then..lucky me, the original mp3s were hidden
so i have all my mp3s..but loads of jpegs and txt files got infected and i couldnt retrieve them like the mp3s....i read the script of the virus...damn....its bad....anyone know how i may be able to get back all what i lost???or is it gone for good??
dont know about restoring your files, but why wernt you running a virus scanner??
I heard about this the other day!!
| quote: |
| Originally posted by jonsimmonds dont know about restoring your files, but why wernt you running a virus scanner?? |
dude that sucks....
i have McAfee Online Virus....and IMO, it's the best...
might not have as many features as Norton, but service is great...
about your files, there was a proggy, forgot it's name tho, it will restore your files....
But were you able to get rid of the virus???
If not, get a free copy of virus scan, and get the virus out of your comp...
If you need removal instructions, i'll try and get them for you...
And about that program, try searching using the SEARCH feature, you should find it...
try this one its free and has done hte job for me, click on the link!
LINK
Jon
About the virusscan proggie, I'm using Norton, way userfriendly, but in quality MCAfee and Norton are similar, they're both the best you can get.
About your problem, a friend of mine had it too. You should run a virusscan, delete the virus and then manually solve the changes.
What the virus does is copy your filenames and create new files with those names. Nothing gets deleted, it just gets messy. You need to delete the useless files to get back to normal. A little effort and problem solved. oh, and next time run a virusscanner!!!! It's better to loose speed than to get nuked by some *ssh*le!!!
| quote: |
| Originally posted by Kamaya About the virusscan proggie, I'm using Norton, way userfriendly, but in quality MCAfee and Norton are similar, they're both the best you can get. About your problem, a friend of mine had it too. You should run a virusscan, delete the virus and then manually solve the changes. What the virus does is copy your filenames and create new files with those names. Nothing gets deleted, it just gets messy. You need to delete the useless files to get back to normal. A little effort and problem solved. oh, and next time run a virusscanner!!!! It's better to loose speed than to get nuked by some *ssh*le!!! |
| quote: |
| Originally posted by Tranex02 dude that sucks.... i have McAfee Online Virus....and IMO, it's the best... might not have as many features as Norton, but service is great... about your files, there was a proggy, forgot it's name tho, it will restore your files.... But were you able to get rid of the virus??? If not, get a free copy of virus scan, and get the virus out of your comp... If you need removal instructions, i'll try and get them for you... And about that program, try searching using the SEARCH feature, you should find it... |
I think you're SOL bud...
Source: Symantec
| quote: |
VBS.LoveLetter and variants Discovered on: May 5, 2000 Symantec Security Response has identified 82 variants of this worm. The latest is VBS.LoveLetter.CN. Virus definitions dated May 31, 2001, or later detect and remove all of these known variants. Occasionally new variants of this worm are discovered. Norton AntiVirus may, at times, detect these new variants as VBS.LoveLetter.Variant. This is a generic detection indicating that the worm is a new variant of VBS.LoveLetter that has not yet been specifically identified and named. NOTE: If Norton AntiVirus detects VBS.LoveLetter.Variant, we suggest that you quarantine and submit the file to SARC for analysis. See the document How to submit a file to Symantec Security Response using Scan and Deliver. You can protect your computer from all known variants of the VBS.LoveLetter worm by downloading the latest virus definitions using LiveUpdate or from http://www.symantec.com/avcenter/download.html. A tool to repair the VBS.LoveLetter infection, including all known variants (except VBS.Loveletter.CA, VBS.Loveletter.BJ, VBS.Loveletter.BM and VBS.Loveletter.AS), is available here. Symantec Security Response began receiving reports regarding this worm in the early morning of May 4, 2000, GMT. This worm originated in Manila, Philippines. It had wide-spread distribution, and infected millions of computers. This worm sends itself to email addresses in the Microsoft Outlook address book and also spreads to Internet chatrooms using mIRC. This worm overwrites files on local and remote drives, including files with the extensions .vbs, .vbe, .js, .jse, .css, .wsh, .sct, .hta, .jpg, .jpeg, .wav, .txt, .gif, .doc, .htm, .html, .xls, .ini, .bat, .com, .avi, .qt, .mpg, .mpeg, .cpp, .c, .h, .swd, .psd, .wri, .mp3, and .mp2. The contents of most of these files are replaced with the source code of the worm, destroying the original contents. The worm also appends the .vbs extension to each of these files. For example, image.jpg becomes image.jpg.vbs. However, files with .mp2 and .mp3 extensions are merely hidden and not destroyed. Norton SystemWorks users can recover these files if NProtect is running at the time of infection. VBS.LoveLetter also tries to download a password-stealing Trojan horse program from a Web site. Also Known As: Lovebug, I-Worm.LoveLetter, VBS/LoveLetter.A, VBS/LoveLet-A Type: Worm Infection Length: 10,307 bytes |
Oh i hate viruses!!
i have a similar problem. I have many different viruses. But i run norton and it cannot repair them, delete them, or quarantin them. AARGH. I emailed them with suggestions and they say delete the files in safemode, and replace it with the original. What does this mean? where can i get this "original" ?
what i am worried about is that files such as the winnit.exe file and other important ones have been infected. Can i really afford to go messing about with such important files?
EKD msg me on MSN, i got this virus about a week ago and i was able to fix it within about... 5-10 min its VERY simple to delete ( unless its already fuckign deleted ur mp3s (rare) )
use the windows find function and do a search for *.vbs then delete everything it fins. if it wont let you delete the MP3s, select the MP3s that mirror the vbs files and play them in winamp. while playing them in winamp delete the VBs mirror
*WARNING* PEOPLE, STOP USING KAZAA...THIS IS THE THIRD PERSON IN THE LAST WEEK I'VE HEARD FROM THAT HAVE GOTTEN THE LOVELETTER VIRUS FROM KAZAA!
My friend's brother just got a brand new computer, he downloaded something from KaZaa and got the Loveletter virus...now is computer is really messed up!
| quote: |
| Originally posted by TeKnoHe@d2025 *WARNING* PEOPLE, STOP USING KAZAA...THIS IS THE THIRD PERSON IN THE LAST WEEK I'VE HEARD FROM THAT HAVE GOTTEN THE LOVELETTER VIRUS FROM KAZAA! My friend's brother just got a brand new computer, he downloaded something from KaZaa and got the Loveletter virus...now is computer is really messed up! |
Diagnosis Please...
My 45 Gig Harddrive officially died on my at approxiamtely 3:25am EST last night...tried to run a 2nd time to make sure all the virus are gone. The comp hung and all I get is a blue screen....
Crap!
Now the major problem --> My Harddrive is making some weird noises...like those you would heard if you walked into a dark, secluded forest...sounds like crickets cricketing 24/7.....
I suspect there is a whole nest of Black Widows in there....anyone got this problem before...
Please don't tell me that my motherboard is fucked...I'm using a backup HD and this is still happening...
Argghh....pissed!
if its blue screening try taking out your sound card and other periphals one at a time. blue screens mean driver failure sometimes, maybe something got fried. The hard drive making noise isnt good...Did you kick it or something. the readers might be scraping the disks. Mobos rarely fail compared to other components. check plugins and did you say something about powersupply? if the voltage is wrong it very well mightve fried your mobo
| quote: |
| Originally posted by Orbax if its blue screening try taking out your sound card and other periphals one at a time. blue screens mean driver failure sometimes, maybe something got fried. The hard drive making noise isnt good...Did you kick it or something. the readers might be scraping the disks. Mobos rarely fail compared to other components. check plugins and did you say something about powersupply? if the voltage is wrong it very well mightve fried your mobo |
in the discussion about protecting PC's..
the last time i checked for spy ware was about 2 weeks...so
i just updated the signature file in Ad-aware...
and i run a check...
I GOT 220 NEW COMPONENTS 
!!!!!!
I couldn't beleive it....
It was basically a couple of files that were repeated over and over...
90% were registery files....
The files were associated with something called
"brilliant digital entertainment"
bde
Atleast i got rid of it now....
220?!??
Oh man.....you've been played and never knew it...
i just discovered something..........
all the mp3s that got infected by th elove letter virus on my comp, are now acting as system files......how do i change them to normal files??? is it something in the registry??i think....cos u cant just change its attributes.....DOS isnt even lookin at em...
please help
| quote: |
| Originally posted by DJ El Kay Dee i just discovered something.......... all the mp3s that got infected by th elove letter virus on my comp, are now acting as system files......how do i change them to normal files??? is it something in the registry??i think....cos u cant just change its attributes.....DOS isnt even lookin at em... please help |
no they are being recognised but they are considered as system files and therefore when u choose not to see system or hidden files, u dont see these mp3s......the system attribute is on...need to know howto remove this association
Powered by: vBulletin
Copyright © 2000-2021, Jelsoft Enterprises Ltd.