Swat the `Love Bug' with a Free Tool from Trend Micro; Solution Will Reverse Some of the Damage Done to Infected Computers

Business Wire, May 5, 2000

Business Editors & High-tech Writers

CUPERTINO, Calif.--(BUSINESS WIRE)--May 5, 2000

Trend Micro Now Detects All Known Variants Including Susitikim,

Mothers Day, Very Funny, Brainstorm, and a Variant Without

a Subject Header

On the heels of yesterday's global attack on computers of the "LoveLetter" virus, Trend Micro Inc. (Nasdaq:TMIC), a leading provider of Internet content security software, is freely distributing a small but potent program named, "SWAT.EXE," to delete "LoveLetter" virus files and restore system integrity on infected PCs until an updated full-strength antivirus solution can be implemented.

Trend Micro made updates available for all its products and placed new pattern files on the web for downloading almost immediately after yesterday's global "Love Bug" outbreak. In an effort to ease the demand for these updated virus-killing products, Trend Micro has decided to release a small standalone program to help users whose computers have been infected by the VBS_LOVELETTER virus. This robust freeware was developed by Trend Micro engineers solely to reverse some of the damage that LoveLetter has left on organizations' networks over the past two days.

According to Trend Micro's online virus tracking system (http://wtc.trendmicro.com), the VBS_LOVELETTER worm infected more than 2.99 million computer files during its one-day swing through Asia, Europe and North America causing many of the world's largest companies and government institutions to grind to a halt. Computer Economics estimated today that the "Love Bug" virus had already caused $2.61 billion in damages worldwide. Because Trend Micro's virus tracking system only monitors a small sampling of actual infections, Trend Micro experts are estimating that more than 10 million computers have been infected.

Official Solutions Available

Just minutes after reports of a new Melissa-like email virus were confirmed on May 4, Trend Micro engineers developed protective code against the VBS_LOVELETTER virus, a worm which auto-spams using MS Outlook and overwrites user files. Within hours, Trend Micro's team of over 200 antivirus specialists in the Philippines and the U.S. quickly developed virus pattern file updates for the company's InterScan(R), ScanMail(R), ServerProtect(R), OfficeScan(tm) and PC-cillin(tm) products. All Trend Micro customers are advised to download the latest pattern file update, No. 697, from http://www.antivirus.com, http://outbreak.antivirus.com, or ftp://ftp.antivirus.com/products/pattern/ as soon as possible. This latest pattern file supports all known variants of VBS_LOVELETTER including "Susitikim", "Mothers Day", "Very Funny", "Brainstorm", and a variant without a subject header. For more information about these variants please visit Trend Micro's Virus Information Center at http://www.antivirus.com/vinfo/.

Free online scanning

Trend Micro's free online virus scanning tool, HouseCall, has also been updated to allow concerned visitors who are not current Trend Micro customers to have their systems thoroughly scanned for the Love Bug and other malicious code. HouseCall can be found at http://housecall.antivirus.com.

Heavy traffic clogs site

Unfortunately, the surprising speed at which the LoveLetter worm spread and the sudden burst of intense media coverage created a dramatic surge of interest in the Internet security industry, sending a heavy flood of Internet traffic to Trend Micro's website and those of other antivirus software providers. In response to this increased demand, Trend Micro has activated a back-up website (http://outbreak.antivirus.com) to enable visitors to obtain the information, file updates or service they desire.

Stopgap tool

Since it is possible that online delays will continue, Trend Micro has decided to release a small, quick downloadable program that enables users to quickly check if their system has been infected by the Love Bug virus, and if so, to clean it. Only 36k, SWAT.EXE is able to find and delete the key files connected with VBS_LOVELETTER, reverse changes the virus makes to the Windows registry and Internet Explorer settings. In simple cases, SWAT.EXE can remove all traces of the email worm. Although it can not guarantee complete removal, it at least stops all virus activity, and makes the computer safe to use again.

The program's major omission is its failure to delete or restore user files, such as JPEG pictures or MP3 music files, which have been infected by the virus and changed to virus-bearing VB script (.vbs) files. While these files will not transmit the virus on their own, the user must be careful not to execute them or the infection will begin again. SWAT provides no protection against brand new Love Bug infections.

SWAT cannot provide complete protection against new LoveLetter infections but it is an effective temporary measure to clean systems until comprehensive antivirus scanning and detection solutions can be executed.

Swatting the "Love Bug"

Instructions for executing SWAT.EXE