# Virus Problem: .jpg ---\> .jpg.vbs

**URL:** <https://boards.straightdope.com/t/virus-problem-jpg-jpg-vbs/110427>\
**Category:** Factual Questions\
**Created:** [May 23, 2002, 3:05am UTC](https://boards.straightdope.com/t/virus-problem-jpg-jpg-vbs/110427 "2002-05-23T03:05:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![n9e9o9](https://avatars.discourse-cdn.com/v4/letter/n/b3f665/32.png) [@n9e9o9](https://boards.straightdope.com/u/n9e9o9)\
**Post date:** [May 23, 2002, 3:05am UTC](https://boards.straightdope.com/t/virus-problem-jpg-jpg-vbs/110427/1 "2002-05-23T03:05:25Z")

</div>

Usually most ppl would go to some tech forum but I thought that I could get advice from the sdmb community…

Somehow my Jpeg files have their extensions converted to .jpg.vbs instead of just .jpg b/c of something i dled

what is the most reliable way to remove the virus and perhaps convert back all files back to their original extensions?

---

<div class="post-metadata">

**Author:** ![Bryan\_Ekers](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bryan_ekers/32/183_2.png) [@Bryan\_Ekers](https://boards.straightdope.com/u/Bryan_Ekers)\
**Post date:** [May 23, 2002, 3:39am UTC](https://boards.straightdope.com/t/virus-problem-jpg-jpg-vbs/110427/2 "2002-05-23T03:39:30Z")

</div>

You can just rename the affected files, deleting the extra extension. The most likely cause is an e-mail virus you opened that looked like a jpg but actually had the extension (filename).jpg.vbs

You should go through your recent mail for any attachments and check each one carefully. If you find one with a .vbs attachment, do an internet search for the file’s name. Odds are somebody has written up the proper procedure.

---

<div class="post-metadata">

**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\
**Post date:** [May 23, 2002, 3:52am UTC](https://boards.straightdope.com/t/virus-problem-jpg-jpg-vbs/110427/3 "2002-05-23T03:52:46Z")

</div>

[http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html](http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html)

> [@](#):
>
> Symantec Security Response has identified 82 variants of this worm. The latest is [VBS.LoveLetter.CN](http://VBS.LoveLetter.CN). Virus definitions dated May 31, 2001, or later detect and remove all of these known variants. Occasionally new variants of this worm are discovered. Norton AntiVirus may, at times, detect these new variants as VBS.LoveLetter.Variant. This is a generic detection indicating that the worm is a new variant of VBS.LoveLetter that has not yet been specifically identified and named.

---

<div class="post-metadata">

**Author:** ![wei](https://avatars.discourse-cdn.com/v4/letter/w/90ced4/32.png) [@wei](https://boards.straightdope.com/u/wei)\
**Post date:** [May 23, 2002, 4:35am UTC](https://boards.straightdope.com/t/virus-problem-jpg-jpg-vbs/110427/4 "2002-05-23T04:35:43Z")

</div>

The virus should should also affect mp3 files, and in that case, just remove all the \*.vbs files and the original mp3 files should just be hidden.

---

<div class="post-metadata">

**Author:** ![Joe\_Cool](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@Joe\_Cool](https://boards.straightdope.com/u/Joe_Cool)\
**Post date:** [May 23, 2002, 8:09am UTC](https://boards.straightdope.com/t/virus-problem-jpg-jpg-vbs/110427/5 "2002-05-23T08:09:12Z")

</div>

Just taking off the .vbs extension won’t fix the problem. Each of those files has (IIRC) vbs code containing the worm itself, which should be removed.