![]() | ![]() |
CUPERTINO, Calif., Updated 7:17 a.m. EDT May 5, 2000 -- In what could be the fastest-spreading computer virus attack ever, the so-called "I Love You" bug swamped a massive number of e-mail systems across the industrialized world on Thursday, erasing multimedia files and shutting down business as experts hurriedly assembled an innoculation.
DISCUSSION: NEXT TIME: TIMELINE:
FREE VIRUS PROTECTION:
READ UP:
|
| |
|
| CERT spokesman Shawn Hernan discusses the 'I Love You' virus. |
Technicians at Cupertino, Calif.-based Symantec and other virus protection firms were rushing to assemble programs to kill the virus and to post a fix on their Web sites.
In Britain, about 30 percent of company e-mail systems were brought down by the virus, according to Network Associates, another computer security firm. In Sweden, the tally was 80 percent. Experts said they were stunned by the speed and wide reach of the virus -- and nobody seemed to know of an immediate cure. "It may be the most comprehensive spreading that I have seen," said Snorre Fagerland of the computer security company Norman in Oslo, Norway, where the virus struck an untold number of companies. New variations of the virus were already circulating by Thursday evening, including one disguised as a joke with an e-mail attachment reading "Very Funny." Apple Macintosh computers were declared immune, as were other e-mail programs such as Netscape. Outlook users who receive an e-mail with "ILOVEYOU" in the subject line are advised not to open the attachment, "LOVE-LETTER-FOR-YOU.TXT." If they do, the virus replicates itself, apparently sending copies of itself to everyone in the user's e-mail address book. The resultant flood of meaningless e-mails slows down systems and makes it difficult to use e-mail for actual communication. Because it only infects a PC when the attachment file is opened, the ILOVEYOU virus is less communicable than the November 1999 "Bubbleboy" virus: Exploiting Outlook's message-preview function, Bubbleboy could infect users' PCs even if they did not open the message. The "Love" virus is activated only when the user double-clicks on the attachment. But ILOVEYOU has a devilish side that Bubbleboy didn't: If a user opens the "Love Letter," the virus attacks multimedia files that were previously stored on the PC -- such as JPEG and GIF image files and MP3 sound files -- and replaces them with dummy versions that contain the virus. "It is less easily transmitted than other viruses, but if your computer is infected, it does much more harm than the traditional virus," said Steve Morman, a NewsNet5 tech-support writer. Users with McAfee or Dr. Solomon brand anti-virus software can download a "patch" that detects the "Love" virus by going to this Web page: zdnet.com/downloads/stories/info/0,0018IN,.html Symantec technicians posted a patch that detects and quarantines the bug. They were hastening to finish a patch that actually deletes the virus and planned to post it shortly on their Web site at www.symantec.com. That site was swamped with requests for information throughout the day, but Symantec officials said they were attempting to activate additional server computers. Name of virus: VBS.LoveLetter.AM Distribution*: This is a preliminary writeup. The information contained within is to provide as much information as possible at this time. VBS.LoveLetter.A is an email worm, mIRC worm, and a file infector. VBS.LoveLetter.A will use Microsoft Outlook and e-mail itself out as an attachment with the above subject line and attachment name. The body of the message will be: The virus will insert the following files: How To Remove*: Delete found infected files. Symantec officials told NewsNet5 that the Love virus looks for those files -- including JPG and GIF type image and MP3 music files -- erases their contents and inserts its virus into the file instead. The virus then renamed your file with a ".vbs" extension at the end. For instance, "mypicture.gif" would become "mypicture.gif.vbs" after the virus attack. Also affected are image files with the extension JPG and MP2 music files, as well as several types of technical files used by Windows such as "VBS" files. Lesson re-learned: Make backup copies of important files, including images and songs. "If you have important files overwritten, they're gone," Shawn Hernan of the CERT computer security center told ThePittsburghChannel.com in a press conference Thusday afternoon. "If you unleash (the virus) on your home computer, hope that you have backups." In Asia, Dow Jones Newswires and The Asian Wall Street Journal were among the victims. "It crashed all the computers," said Daphne Ghesquiere, a Dow Jones spokeswoman in Hong Kong. "You get the message and the topic says 'ILOVEYOU,' and I was among the stupid ones to open it. I got about five at one time and I was suspicious, but one was from Dow Jones Newswires, so I opened it." The virus was widespread in Europe as well. In Denmark, the parliament, telecom company Tele Danmark, channel TV2 and the Environment and Energy Ministry were all affected starting this morning. Experts said they were stunned by the speed and wide reach of the virus -- which struck members of U.S. Congress and British parliament -- and warned computer users not to open the "LOVELETTER" attachment that comes with the contaminated e-mail. "I have to tell you that, sadly, this affectionate greeting contains a virus which has immobilized the House's internal communication system," said Margaret Beckett, leader of Britain's House of Commons. "This means that no member can receive e-mails from outside, nor indeed can we communicate with each other by e-mail." In the United States, the "love bug" shut down the Florida Lottery Web site and e-mail system, said lottery spokesman Leo DiBenigno. U.S. Chamber of Commerce estimated 350,000 computers in the U.S. had been infected by 1 p.m. ET Thursday. The White House declined to give NewsNet5 an estimate of the extent of the attack. CNN estimated the dollar value of the damage wreaked by the virus in the hundreds of millions as computer files were wrecked and business was lost, including from crashed financial networks and cash machines. ABC reported that U.S. State Department and military computers were infected. In Pittsburgh, the zoo and main hospital reported problems ,while the airport and district attorney's office had to shut down their Internet connections.
Copyright 2001 by NewsNet5. The Associated Press
contributed to this report. All rights reserved. This material may not be
published, broadcast, rewritten or redistributed.Extent Of The Attack
By midday Eastern time, a virus scanning system provided on the Internet by the Trend Micro computer security company had already detected more than 500,000 infected computer files around the world, including more than 350,000 in the United States.Virus Attacks Outlook
The virus, which affects only versions of Microsoft's Outlook e-mail program, floods e-mail inboxes by reproducing itself.How To Fight It
Anti-virus experts recommended that people who receive e-mails entitled "ILOVEYOU" delete all of them without opening the attachment. Computer system administrators are advised to set up filters that screen out e-mails with the incriminating subject line and file attachment. (see below for more advice).Symantec's Advisory
Thursday morning, Symantec posted an advisory instructing users to delete, without opening, any e-mails with "ILOVEYOU" in the subject line. The full text is below (originally posted at symantec.com):
This is an email worm, mIRC worm, and file infector.
Technical description*:kindly check the attached LOVELETTER coming from me.
The virus will also infect files with the following extensions: vbs, vbe, js, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2
SARC recommends Administrators filter on the attachment name and Subject line immediately.What It Does To Files
If you've been infected by "ILOVEYOU" haven't created backups of multimedia files on your PC, you may feel more hatred than love. They're probably gone.Virus' Path Around The World
The virus first emerged in Asia: Initial reports have differed on whether the source appears to be Hong Kong or the Phillipines.
© 2004,
Internet Broadcasting Systems, Inc. Click here for the privacy policy, terms of use. Click here for advertising information. Site Map |