✔ 最佳答案
VBS:LoveLetter searches for the certain files on all local and remote drives. If it finds the file with extension jpg and jpeg, they are overwritten and renamed to *.jpg.vbs, while mp3 and mp2 files are copied to *.mp?.vbs , this copy is overwritten by worm and the attribute of original file is changed to hidden.
Get the fix here:
http://www.sarc.com/avcenter/venc/data/fix.vbs.loveletter.html
The VBS.LoveLetter Fix tool removes the changes that were made to a computer by all known versions of the VBS.LoveLetter worm except VBS.LoveLetter.CA, VBS.LoveLetter.BJ, VBS.LoveLetter.BM and VBS.LoveLetter.AS.
CAUTION: Before you run the tool, you must update to the most recent virus definitions and run a full system scan, making sure that Norton AntiVirus (NAV) is set to scan all files. If you run the tool before scanning your system, you may see warnings that indicate that files have been infected with LoveLetter. If you see any such warning, choose to delete the files.
NOTES:
This tool will have limited effectiveness if you have been infected with VBS.NewLove.A. This variant of LoveLetter destroys all files on the system that are not in use. Therefore an infected system will most likely be unstable. If you are running this tool on Windows NT or Windows 2000, you must have Administrator-level privileges. When the tool has finished running, you will see a message indicating whether or not the computer was infected by VBS.LoveLetter. If you are an administrator, and you want to run the tool without displaying the information dialog box, run the tool with the /auto command line switch; for example, C:\Windows\Desktop\fixlove.exe /auto
To obtain and run the tool: Go to
http://www.symantec.com/avcenter/fixlove.exe. Download the file to your Windows Desktop. Double-click the Fixlove.exe file to start the repair tool. Click Remove! to begin the process, and allow the tool to run.