Recovery From Love (Bug) Sickness

Still fighting the Love Bug? Business is busy for antivirus and file-recovery tool vendors, which offer a selection of wares to help restore your system to its old self.

Now available from Symantec AntiVirus Research Center, fixlove.exe is a free tool to repair the Windows registry and Internet Explorer settings damaged by VBS.LoveLetter.A.worm and its variants. For $49, EasyRecovery for VBS.LoveLetter Worm from Ontrack Data can help recover lost image and music files. Both tools are to be used only after you've cleaned your system with updated antivirus software.

"After you scan and delete infected files, the fix tool spends most of its time fixing registry settings," says Patrick Martin, a Symantec product manager.

The so-called Love Bug, or Love Letter virus, traveled by e-mail identifiable by the subject header "ILOVE YOU." The virus propagated by relaunching itself continuously to another group of victims, drawing names from address books maintained by Microsoft Outlook.

A poll distributed by Angus Reid Group and Symantec finds 26 percent of those with Internet access at work say their companies were exposed to the Love Letter virus. Only 3 percent of those with computers at home reported problems.

The Love Letter worm creates a registry key for each system it enters through e-mail, Martin says. "We go in and delete those excess registry keys."

Fixlove.exe resets your home page to Symantec and uncovers hidden MP3 and MP2 files, Martin says. But it doesn't recover deleted image files.

You can do everything fixlove.exe does manually, but unless you're experienced with registry keys and hidden files, it's best to use the tool, Martin says.

In Search of Image Files

Part of Norton System Works, Nprotection can recover your lost JPEGs, provided it was running when you were attacked, Martin says.

If you didn't have that foresight, Ontrack's EasyRecovery offers extensive file recovery. It extracts JPEG, JPG, MP3, and MP2 files to a path you select, and restores them with numerical names but appropriate file extensions.

It's difficult to recover images eaten by the Love Letter worm, says Jim Reinert, director of software products at Ontrack. The virus leaves a copy of the original JPEG in free space area of your hard drive, which is not normally accessible, he adds.

EasyRecovery searches, finds, and identifies blocks of data as JPEG files, Reinert says. "It uses signature matching to bring back pieces."