LOVE-LETTER-FOR-YOU.HTM:

LOVE-LETTER-FOR-YOU.HTM

This worm sends itself to email addresses in the Microsoft Outlook address book and also spreads itself into Internet chatrooms via mIRC. This worm overwrites files on local and remote drives, including files with the extensions
    Delete the file Win32DLL.vbs from the Windows directory
  • Delete the following files from the Windows\system directory:
    MSKernel32.vbs ,LOVE-LETTER-FOR-YOU.TXT.vbs,LOVE-LETTER-FOR-YOU.HTM
    WINFAT32.EXE,WIN-BUGSFIX.EXE,Funny Love.vbs,Funny Love.htm
  • Remove winfat32.exe, win-bugsfix.exe,and all .VBS entries from the following registry keys:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
    \CurrentVersion\Run
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\RunServices
    HKEY_USERS\username\Software\Microsoft\Windows\
    CurrentVersion\Run
    This is modified for all users in HKEY_USERS.
  • Remove all DWORD values from the registry key
    HKEY_USERS\username\SOFTWARE\Microsoft\WAB
    except for LDAP Connection Timeout and Server ID. This is done for all users in HKEY_USERS.
  • Search all local hard drives for hidden MP3 and MP2 files.
    The hidden attribute will then be removed.
  • Search all local hard drives for LoveLetter SCRIPT.INI files.