SAN MATEO (05/08/2000) - Symantec Corp. Monday posted a free Love Bug repair tool, which helps eliminate the side effects for those who have been hit by the notorious e-mail worm or its multiple variations.
The tool, called FIXLOVE.EXE, repairs damage to the e-mail registry as well as Microsoft Internet Explorer settings altered by Love Bug, although it cannot restore deleted or overwritten files.
"This computer worm will actually enumerate, or list, every single targeted e-mail address in the registry that it has hit so that it does not resend itself out to each address again," said Carey Nachenberg, chief researcher at Symantec Anti-Virus Research Center. "In doing so, if you have a corporation of 100,000 people, it will add literally 100,000 new registry entries to the system, which can cause sluggishness or even cause your machine to crash.
[FIXLOVE.EXE] will go through and remove essentially tens or hundreds of thousands of registry keys from your system that were created by the worm to eliminate any potential problems."
Nachenberg added that the Love Bug fix should be run after an anti-virus solution has already deleted the virus files from company systems, because the fix is "a side-effect cleaning solution."
Symantec is providing the fix for free for computers running Windows 95, 98, 2000, or Windows NT at www.sarc.com. The tool also handles variants of the Love Bug worm, including one with the subject line "Virus ALERT!!!" that poses as a message from Symantec technical support. Symantec is currently tracking about 14 major versions that are actively spreading, and users receiving the fix by e-mail can verify FIXLOVE.EXE's digital signature at www.wmsoftware.com/pub/chktrust.exe.
The need to "clean up" after a virus is becoming more vital to businesses trying to get back on their feet after an attack, and Nachenberg said these side-effect fixes will soon be rolled into Symantec anti-virus software.
"Our anti-virus software in the next generation will actually be able to perform all of these tasks in addition to removing the viruses and detecting the viruses," he said. "[Cleaning up side effects is] actually becoming more of a problem on the Windows systems where the typical virus takes its tendrils and sticks them all over the place, instead of just attaching itself onto a file, it modifies the registry, initialization files, etc. It's becoming more of a need and we definitely are addressing that."
Symantec Corp., in Cupertino, California, is at www.symantec.com.