VBS.NewLove.A - Removal

The contents of all files will be deleted, leaving the affected files with a byte length of zero.

The worm also appends the .vbs extension to each of these files. For example, the calc.exe file becomes calc.exe.vbs.

Because this worm overwrites all files regardless of extension, proper removal can only be achieved by restoring the affected files from known clean backups. The user may need to reinstall the operating system as well as system files may have been destroyed.

Technical Details