DiscoverScroll article

ILOVEYOU, sometimes referred to as the Love Bug or Loveletter, was a computer worm that infected tens of millions of Windows computers following its release on 4 May 2000.

The worm was mainly distributed through email attachments sent to contacts on an infected system's address book, and is an example of malware using social engineering to aid its spread. Once ran, the worm overwrites files with its source code and attempts to spread to other computers. The worm was created by Onel de Guzman, a dropout of AMA Computer College in the Philippines, because of his belief that internet access was a human right; the worm attempts to download a computer trojan that steals dial-up Internet access credentials to fulfil this aim. Philippine prosecutors ultimately dropped all charges against de Guzman because of a lack of laws against hacking in the country. In response, President Joseph Estrada signed an e-commerce law to cover against similar activity. Affecting an estimated 10% of internet-connected computers at the time, the ILOVEYOU worm is considered to be one of the most virulent examples in the history of malware. The worm caused approximately US$10 billion worth of damages to numerous government agencies and corporations. It has inspired several creative works, including art installations, songs and films.

The ILOVEYOU worm was coded by Onel de Guzman, a former student at AMA Computer College in the Philippines.

De Guzman wrote ILOVEYOU in the programming language VBScript. The worm was found in emails with the subject "ILOVEYOU" and a message of "kindly check the attached LOVELETTER coming from me." The attachment LOVE-LETTER-FOR-YOU.TXT.vbs contained the worm. Upon opening the file, the worm creates copies of itself that are run upon reboot of the computer. The worm attempts to download a trojan horse named WIN-BUGSFIX.exe. The worm sends its trademark email to all contacts in the victim's address book. The worm records which address book entries it has sent emails to, so only one email is sent to each contact even if the worm is run multiple times. ILOVEYOU also has the capability to spread via Internet Relay Chat channels.

ILOVEYOU used social engineering to aid its spread, encouraging potential victims to open the infected attachment by playing on their romantic desires. The attachment used a file name that took advantage of a feature of Microsoft Windows, "Hide extensions for known file types", where only the base file name would be displayed.

Since ILOVEYOU was coded in VBScript, it was relatively easy to modify the worm’s code and change its behaviour. Over 25 variants of the ILOVEYOU worm have been recorded. Variants of ILOVEYOU differed from the original worm in many aspects, such as changing which file extensions were affected, and modifying the worm's email subject and body to target specific audiences. Computer worm NewLove, which spread in a similar fashion to ILOVEYOU, was especially destructive since it targeted every file on the victim's hard drive until their computer stopped working and evaded antivirus software.

De Guzman designed ILOVEYOU to only work in Manila. In the United States, the worm affected most federal government agencies, including the Department of Justice, the Department of Labor and the Social Security Administration. The Veterans Health Administration received 7,000,000 ILOVEYOU emails during the outbreak, requiring 240 man-hours of work to resolve the problems created.

ISPs also linked ILOVEYOU to a phone line registered to an apartment associated with de Guzman.

ILOVEYOU has repeatedly been named as one of the most destructive and virulent pieces of malware in history. To address legislative deficiencies against computer hacking, Philippine President Joseph Estrada signed an e-commerce law in June 2000.

The Persistence of Chaos, a laptop infected with notable malware including ILOVEYOU, was sold at auction in 2019 by Chinese artist Guo O Dong.

Quick Facts

• Affecting an estimated 10% of internet-connected computers at the time, the ILOVEYOU worm is considered to be one of the most virulent examples in the history of malware.
• The worm was mainly distributed through email attachments sent to contacts on an infected system's address book, and is an example of malware using social engineering to aid its spread.
• Once ran, the worm overwrites files with its source code and attempts to spread to other computers.
• Philippine prosecutors ultimately dropped all charges against de Guzman because of a lack of laws against hacking in the country.
• In response, President Joseph Estrada signed an e-commerce law to cover against similar activity.

Source material: Wikipedia - "ILOVEYOU". Adapted and summarized for DiscoverScroll. Original contributors are credited through the linked Wikipedia article. Read original on Wikipedia. CC BY-SA 4.0. Changes were made from the original.