Symantec provides free tool to repair damage from LoveLetter worm

Symantec today announced the availability of a comprehensive tool to repair the damage to the registry and the changes to the Internet browser settings caused by the VBS.LoveLetter.A worm and its variants. This automatic tool, FIXLOVE.EXE, is available now at no charge for computers running Windows 95, 98, NT or 2000 from

.

This FIXLOVE.EXE tool will automatically repair the registry and Microsoft Internet Explorer settings damaged by the VBS.LoveLetter.A worm and its variants. In addition IT administrators can automate the repair process by running the FIXLOVE.EXE tool from either the DOS command line or from a login script.

End-users and IT administrators should run the FIXLOVE.EXE tool after they have scanned their systems with an anti-virus solution, such as Symantec's Norton AntiVirus, which will delete the virus files from the system. Users should note that FIXLOVE.EXE cannot restore deleted or overwritten files, which can only be recovered from a backup file or an undelete tool such as the NPROTECT/UNERASE utilities found in Symantec's Norton SystemWorks.

Users can verify the digital signature in Symantec's FIXLOVE.EXE tool at www.wmsoftware.com/pub/chktrust.exe to ensure that the tool is legitimate in case they receive it via e-mail. Users need to be careful since there is a strain of the worm that includes the subject line "Virus ALERT!!!" posing as a message from Symantec technical support. The attachment included in that e-mail is titled "Protect.VBS" and is NOT being distributed by Symantec. If users receive that e-mail, they should delete it immediately.

Norton AntiVirus customers should make sure they have the current virus definition updates before scanning their systems. Updated virus definitions for all variants are available now via Symantec's LiveUpdate and can also be downloaded from www.symantecstore.com and www.digitalriver.com/symantec.

For computer users who may not currently have an anti-virus solution installed, Symantec also offers a free online scan for your system at www.symantec.com. Using Symantec's award-winning anti-virus technology, the Norton Internet Security Analyzer conducts an online scan of the user's computer to determine if it is infected. In addition, the Security Analyzer also can evaluate a computer's overall security status to make sure it is protected from hackers, inappropriate content, and privacy threats. Symantec's Security Analyzer and Virus Check programs are also available on ZDNet's Cybercrime web site at www.cybercrime.com. The VBS.LoveLetter.A worm and its variants have accounted for more than 25 percent of the viruses found on the almost 5,000 PCs scanned since the launch of the Norton Internet Security Analyzer tool on Symantec's web site

The VBS.LoveLetter.A worm contains a malicious payload that can result in non-recoverable data and/or inoperable computer systems. It was first discovered on May 4, 2000 in Asia and quickly spread worldwide. The variants of the worm currently being distributed via e-mail include the following subject lines: "ILOVEYOU," "Susitikim shi vakara kavos puodukui . . .," "fwd: Joke," "Mothers Day Order Confirmation," "Dangerous Virus Warning," "Important! Read carefully!!" and "Virus ALERT!!!". For more information on the VBS.LoveLetter.A worm and its variants, please visit the Symantec web site at www.symantec.com.