One method for eliminating some of the damage that can be caused by the "ILOVEYOU" virus is to go back to a time before a computer was infected. This can sometimes be accomplished by restoring a previous version of the Windows registry. Fortunately, Windows keeps several copies of the registry and rolling a system back to any one of those is very simple. Just follow these few steps.
To restore a previous Windows Registry on systems running Windows 98
- Reboot the computer.
- As the boot process begins, hold down the Control key (Ctrl).
- When the boot-up menu appears, select option 5, "Command Prompt Only."
- When the C:> prompt appears, type "scanreg" and press the Enter key. This invokes the scanreg utility program.
- Scan the current registry.
- Choose the "View backups" option to display a list of recent backups of the Windows registry.
- Scroll and highlight the version of the registry you wish to restore from.
- Choose "restore."
- When the restore process is complete, the scanreg utility displays a dialog box with the title "You have restored a good registry."
- Choose "Restart" to reboot the computer with the selected registry version.
Editor's note: This process will not eliminate all problems, such as appending the file extension .vbs to existing files. But it should, in most instances, allow the system to be rebooted cleanly.
Disclaimer: ITworld.com Inc. cannot and does not assume responsibility for any loss resulting from use of this procedure. Any process that involves the Windows registry should be undertaken only by IT professionals with experience in this technical discipline.
For additional help, visit ITworld.com's Expert Advice, the Web's meeting place where IT professionals go to get expert answers to technical questions.