Class Trojan
Platform Win32

Technical Details

this text was written by Alexey Podrezov, Data Fellows Ltd

This Trojan, when run, shows nothing important on the screen imitating hard disk
formatting and Flash Bios corruption. At the same time, it copies itself to
the Windows directory and modifies the Windows registry to be run upon the next
Windows start-up. It also renames WIN.COM to WIR.COM so Windows cannot be
started normally any more. Even if you rename WIR.COM to WIN.COM and
start Windows, the Trojan will run, repeate its activities and shutdown
Windows. The Trojan also modifies some Windows settings in the registry. The
only way to get rid of it is to manually delete LOVEYOU.EXE from the Windows
directory (from DOS prior to Windows startup) and then rename WIR.COM back

Find out the statistics of the threats spreading in your region