ILOVEYOU
In Love Letter, often also called " I-love -you- virus " is a computer worm that explosively spread by e -mail on 4 May 2000 and the following days. The subject line was " ILOVEYOU ". The worm caused damage amounting to an estimated $ 10 billion worldwide.
Reaction of the public
Due to its rapid and wide dissemination and the height of the resulting damage, the issue was covered by the mass media and moved into the public consciousness. In this way, many computer users in Europe were warned long before the anti -virus software manufacturers have updated their signatures.
Author
The alleged copyright has not been convicted. . There was a " unique " comment in the first two lines of the script:
Rem baroque - loveletter ( vbe ) rem by: spyder / [email protected] / @ GRAMMERSoft Group / Manila, Philippines dissemination strategies
In addition to the curiosity -inspiring subject " I love you" trying deliberately to weigh the receiver false sense of security - he sent on entries from the personal address book, so that the recommendation " Do not open email attachments from strangers " did not intervene. In addition, the appendix was called LOVE- LETTER-FOR - YOU.TXT.vbs so that many recipients at. " Txt files are harmless " remembered as the correct extension. Vbs is not displayed in a standard Windows installation.
While Love Letter can be received and executed with any e -mail programs, it needs to send e -mails Microsoft Outlook, which he controls remotely via OLE Automation. This enabled him to also personal firewalls long time can not be recognized because these registered only communication from Outlook to the mail server.
In addition, he replaced on the hard drive of the infected computer and the Microsoft Network Neighborhood files with certain types with a copy of itself If this file was then exported from another computer, this PC was also infected.
Finally he was able to spread through the IRC network via DCC. To this end, he searched the hard drive for the IRC client mIRC and wrote script.ini the file. It contains a script that Love Letter is sent to all those who join a channel, in which the already infected user resides.
Damage routine
The worm put on infected computers all files with the file extensions. Jpg,. Jpeg,. Vbs,. Vbe. Js. Jse. Css. Wsh, sct. , And. Hta and put a same copy of itself with the file extension. vbs to. In addition, all files are with extensions. Mp2 and. Mp3 marked as hidden and in turn created a same copy of the worm with the. Vbs.
Due to its exponential distribution he has overloaded many mail servers in the first hours. The following statement illustrates this: Assuming that each infected user has 20 entries in his address book and open half of the receiver the Appendix:
Variants
Because the worm consists of a script file that can be edited with any ordinary editor, there are more than 100 variations. Often it involves only small changes, such as an alternate e -mail or IRC text or other file name. Some of these freeloaders could be pried and arrested.