How to Recover from the ILOVEYOU (VBS/Loveletter) Virus

The VBS/Loveletter (aka ILOVEYOU or LoveBug) virus is quite destructive because it adds files, changes Windows registry entries, deletes some files and makes others hidden. This page provides information on how to clean an infected system of the original version of this virus. Be aware, though, that many variations exist that may require additional or different recovery procedures. The pages listed at ILOVEYOU Virus Links should give you an idea of what damage any particular variant may have done to your system. 

Many thanks to Chris Waters and Siegfried Weber for their contributions to this report, via the Outlook-users mailing list.

 Stop the Virus | Delete Messages and Files | Fix Windows Registry | Recover Files | More Information

Stop the Virus

Delete Messages and Files

In Outlook, use Tools | Advanced Find to locate any items with one of these subjects and a file attachment. Delete them:

Delete the following files, adjusting the paths as needed to match your system. Start | Find is probably the best way to locate all of these:

Delete or examine all VBS and VBE files on your system. The virus will have overwritten these types of files with copies of itself. 

The virus also deletes JS, JSE, CSS, WSH, SCT, HTA, JPG, and JPEG files. It then saves another copy of the payload virus script using the original file's name, with the VBS extension added, e.g. image.jpg.vbs. The files will all have the same size and the date and time that the virus ran. You should delete these files as well. 

If you use Internet Relay Chat, look for a file named Script.ini. If it contains a reference to LOVE-LETTER-FOR-YOU.HTM, you'll need to delete it or replace it with your original Script.ini, if you have a backup.

Don't forget that there are variants with other subject lines and attachment names that may affect other files. See ILOVEYOU Virus Links for sites with the latest information on these variants.

Fix Windows Registry

Remove the following Windows Registry entries:

Rename the value of the following registry entry to your desired Internet Explorer home page:

You may need to restore these registry entries to HKEY_CURRENT_USER, HKEY_USERS and HKEY_LOCAL_MACHINE. A system policy file that loads at network logon should take care of that automatically:

Recover Files

As noted above, the virus deletes many web-related and script files, replacing them with copies of itself. The only way to recover those files yourself is from a backup copy or by reinstalling the program that provided the files in the first place. 

More Information

Updated Jul 16 2008

Home | What's New | Exchange Server | Outlook | Utilities | Bookstore
About Slipstick | Feedback | Privacy Policy | Site Map | Archived Pages | Link to Us | Advertise