Script detects infected files

In May of 2000 I was consulting for the McGowan Consulting Group (a.k.a. Strategic Business Systems) as one of two network administrators for Sikorsky Aircraft – Comanche Project.  I was still recovering from the work involved with preparring for Y2K and looking forward to see the movie “Gladiator” when I was forced to deal with the LoveLetter virus (a.k.a. ILOVEYOU or LoveBug), which was running rampant, infecting millions of computers globally.  To this day it is still considered one of the most damaging viruses of all time.  At the time,  antivirus manufacturers were scrambling to detect and defend against it’s infections.  Instead of waiting, I decided to write a script to locate infected files and then to delete them.  I later published an article about this script with Win32 Scripting Journal a.k.a. Windows 2000 Magazine a.k.a. Windows IT Pro.

Article Source:

In response to the Love Letter virus, I wrote a script, LLClean.vbs, that scans Windows 2000 and Windows NT systems’ drives, parses all .vbs files, and deletes those files with the virus. The script scans all hard disks and attached drives. However, the script doesn’t scan Win2K’s hidden system folder System Volume Information because any search of this folder generates an error.Watch Full Movie Online Streaming Online and Download

When the script scans a file, it reads the file’s first line and compares that line with a specified search phrase. If the script finds a match, it immediately deletes the file. The script records all file scans, deletions, and errors in a log file. In the script, this file’s path is C:llscan.log, but you can change it to whatever you want.Watch movie online The Transporter Refueled (2015)

In its current form, the script scans files that have the .vbs extension and searches for the Love Letter virus phrase rem barok -loveletter(vbe) <i hate go to school>. You can customize this script to scan other types of files and to delete other viruses. You can also modify the script to scan the entire document instead of the first line. (For information about how to scan the entire document, see Dino Esposito, “Understanding VBScript: The TextStream Object,” May 2000.) You can even adapt this script to remove unwanted files (e.g., .tmp files).

Listing 1, page 16, contains an excerpt from LLClean.vbs that shows the script’s subroutine that finds and deletes the targeted files. You can find the entire script in the Code Library on the Win32 Scripting Journal Web site (

To use LLClean.vbs, you need to have Windows Script Host (WSH) installed on the system from which you’ll run this script. Before running the script, you must disable any program that might prevent the script from accessing infected files (e.g., virus scanners). This script deletes only infected files and doesn’t address any Registry changes that the Love Letter infection might have caused. This script isn’t meant as a replacement for an up-to-date virus scanner but rather an interim measure until you get one.

Listing 1

Complete Script

streaming L’ora legale movie