NewsNet5.comHome
The Help You NeedHouse & HomeFoodReal EstateLawAutoTravel
EntertainmentEducationEmploymentAsk An ExpertGolfShoppingYellow PagesFamilyDating

'Love' Virus Clogs E-Mail Worldwide

Don't Open That 'LOVE LETTER' Attachment!


CUPERTINO, Calif., Updated 7:17 a.m. EDT May 5, 2000 -- In what could be the fastest-spreading computer virus attack ever, the so-called "I Love You" bug swamped a massive number of e-mail systems across the industrialized world on Thursday, erasing multimedia files and shutting down business as experts hurriedly assembled an innoculation.

"Love" Virus Strikes: The Extent Of The Attack ... How It Spreads Through Microsoft Outlook E-mail ... How To Fight It ... How It Affects Graphics And Music Files ... Virus' Path Around The World

Beware the Life_Stages virus! Illustration by Susanna Yoemans for IBS

DISCUSSION:

  • Your Office Affected?

    NEXT TIME:

  • How To Avoid E-Mail Viruses
  • McAfee's virus alert page

    TIMELINE:

  • Recent Viruses

    FREE VIRUS PROTECTION:

  • Computer Associates InoculateIT
  • Network Associates/McAfee
  • ProLand Software
  • Sophos
  • Symantec/Norton AntiVirus
  • TrendMicro

    READ UP:

  • Virus Alert -- C|Net's primer on virus characteristics, hoaxes and prevention.
  • Check out these Anti-Virus software reviews from ZDNet and Sharepaper.com.

  • Separating fact from fiction: The Truth About E-mail Viruses.

    PAST VIRUSES:

  • May 19, 2000: 'NewLove' Virus Changes Its Name
  • May 4, 2000: 'ILOVEYOU' Attack
  • April 2000: 911 Virus
  • March 2000: 'Park' Virus Returns
  • November 1999: Bubbleboy
  • October 1999: VBS/Freelink Makes A Comeback
  • June 1999: WormExplore.Zip and its spinoff, Mini-Zip
  • April 1999: Chernobyl
  • March 1999: The Melissa Virus and its spinoffs
  • "From the standpoint of spreading and infection rates, it's pretty much the worst," Patrick Martin, product manager for Symantec Antivirus Research Center, told NewsNet5. "Not in the sense of the most damaging, but in how many people are getting affected, it appears to be the fastest virus."

    Video SupplementVIDEO
    Image Description
    CERT spokesman Shawn Hernan discusses the
    'I Love You' virus.
    Symantec officials told NewsNet5 that reports of computers infected by the "Love" virus were coming in 10 times as fast as the comparable period during the March 1999 "Melissa" virus attack.

    Technicians at Cupertino, Calif.-based Symantec and other virus protection firms were rushing to assemble programs to kill the virus and to post a fix on their Web sites.

    Extent Of The Attack

    By midday Eastern time, a virus scanning system provided on the Internet by the Trend Micro computer security company had already detected more than 500,000 infected computer files around the world, including more than 350,000 in the United States.

    In Britain, about 30 percent of company e-mail systems were brought down by the virus, according to Network Associates, another computer security firm. In Sweden, the tally was 80 percent.

    Experts said they were stunned by the speed and wide reach of the virus -- and nobody seemed to know of an immediate cure.

    "It may be the most comprehensive spreading that I have seen," said Snorre Fagerland of the computer security company Norman in Oslo, Norway, where the virus struck an untold number of companies.

    New variations of the virus were already circulating by Thursday evening, including one disguised as a joke with an e-mail attachment reading "Very Funny."

    Virus Attacks Outlook

    The virus, which affects only versions of Microsoft's Outlook e-mail program, floods e-mail inboxes by reproducing itself.

    Apple Macintosh computers were declared immune, as were other e-mail programs such as Netscape.

    Outlook users who receive an e-mail with "ILOVEYOU" in the subject line are advised not to open the attachment, "LOVE-LETTER-FOR-YOU.TXT."

    If they do, the virus replicates itself, apparently sending copies of itself to everyone in the user's e-mail address book. The resultant flood of meaningless e-mails slows down systems and makes it difficult to use e-mail for actual communication.

    Because it only infects a PC when the attachment file is opened, the ILOVEYOU virus is less communicable than the November 1999 "Bubbleboy" virus: Exploiting Outlook's message-preview function, Bubbleboy could infect users' PCs even if they did not open the message. The "Love" virus is activated only when the user double-clicks on the attachment.

    But ILOVEYOU has a devilish side that Bubbleboy didn't: If a user opens the "Love Letter," the virus attacks multimedia files that were previously stored on the PC -- such as JPEG and GIF image files and MP3 sound files -- and replaces them with dummy versions that contain the virus.

    "It is less easily transmitted than other viruses, but if your computer is infected, it does much more harm than the traditional virus," said Steve Morman, a NewsNet5 tech-support writer.

    How To Fight It

    Anti-virus experts recommended that people who receive e-mails entitled "ILOVEYOU" delete all of them without opening the attachment. Computer system administrators are advised to set up filters that screen out e-mails with the incriminating subject line and file attachment. (see below for more advice).

    Users with McAfee or Dr. Solomon brand anti-virus software can download a "patch" that detects the "Love" virus by going to this Web page: zdnet.com/downloads/stories/info/0,0018IN,.html

    Symantec technicians posted a patch that detects and quarantines the bug. They were hastening to finish a patch that actually deletes the virus and planned to post it shortly on their Web site at www.symantec.com. That site was swamped with requests for information throughout the day, but Symantec officials said they were attempting to activate additional server computers.

    Symantec's Advisory

    Thursday morning, Symantec posted an advisory instructing users to delete, without opening, any e-mails with "ILOVEYOU" in the subject line. The full text is below (originally posted at symantec.com):

    Name of virus: VBS.LoveLetter.AM
    This is an email worm, mIRC worm, and file infector.

    Distribution*:

    Technical description*:

    This is a preliminary writeup. The information contained within is to provide as much information as possible at this time. VBS.LoveLetter.A is an email worm, mIRC worm, and a file infector. VBS.LoveLetter.A will use Microsoft Outlook and e-mail itself out as an attachment with the above subject line and attachment name. The body of the message will be:

    kindly check the attached LOVELETTER coming from me.
    The virus will also infect files with the following extensions: vbs, vbe, js, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2

    The virus will insert the following files:

    SARC recommends Administrators filter on the attachment name and Subject line immediately.

    How To Remove*: Delete found infected files.

    What It Does To Files

    If you've been infected by "ILOVEYOU" haven't created backups of multimedia files on your PC, you may feel more hatred than love. They're probably gone.

    Symantec officials told NewsNet5 that the Love virus looks for those files -- including JPG and GIF type image and MP3 music files -- erases their contents and inserts its virus into the file instead. The virus then renamed your file with a ".vbs" extension at the end. For instance, "mypicture.gif" would become "mypicture.gif.vbs" after the virus attack.

    Also affected are image files with the extension JPG and MP2 music files, as well as several types of technical files used by Windows such as "VBS" files.

    Lesson re-learned: Make backup copies of important files, including images and songs.

    "If you have important files overwritten, they're gone," Shawn Hernan of the CERT computer security center told ThePittsburghChannel.com in a press conference Thusday afternoon. "If you unleash (the virus) on your home computer, hope that you have backups."

    Virus' Path Around The World

    The virus first emerged in Asia: Initial reports have differed on whether the source appears to be Hong Kong or the Phillipines.

    In Asia, Dow Jones Newswires and The Asian Wall Street Journal were among the victims. "It crashed all the computers," said Daphne Ghesquiere, a Dow Jones spokeswoman in Hong Kong. "You get the message and the topic says 'ILOVEYOU,' and I was among the stupid ones to open it. I got about five at one time and I was suspicious, but one was from Dow Jones Newswires, so I opened it."

    The virus was widespread in Europe as well. In Denmark, the parliament, telecom company Tele Danmark, channel TV2 and the Environment and Energy Ministry were all affected starting this morning.

    Experts said they were stunned by the speed and wide reach of the virus -- which struck members of U.S. Congress and British parliament -- and warned computer users not to open the "LOVELETTER" attachment that comes with the contaminated e-mail.

    "I have to tell you that, sadly, this affectionate greeting contains a virus which has immobilized the House's internal communication system," said Margaret Beckett, leader of Britain's House of Commons. "This means that no member can receive e-mails from outside, nor indeed can we communicate with each other by e-mail."

    In the United States, the "love bug" shut down the Florida Lottery Web site and e-mail system, said lottery spokesman Leo DiBenigno.

    U.S. Chamber of Commerce estimated 350,000 computers in the U.S. had been infected by 1 p.m. ET Thursday. The White House declined to give NewsNet5 an estimate of the extent of the attack.

    CNN estimated the dollar value of the damage wreaked by the virus in the hundreds of millions as computer files were wrecked and business was lost, including from crashed financial networks and cash machines. ABC reported that U.S. State Department and military computers were infected.

    In Pittsburgh, the zoo and main hospital reported problems ,while the airport and district attorney's office had to shut down their Internet connections.

    Copyright 2001 by NewsNet5. The Associated Press contributed to this report. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.



    Site Map