The World's Worst Computer Virus

May 5, 2000, a very average day for the very average business supervisor. Though in just a couple of hours, it would quickly turn into a day of utter chaos and turmoil. Nearly every install of brand-new computer software damaged beyond repair, over 13,000 pieces of malware detected in just one office building, and soon, over $20 billion in damage seen all across the world. What happened?

These catastrophic events were the work of a new computer worm that was circulating the internet: “ILOVEYOU.” Quite an ironic name, but it was derived from the fact that the worm would disguise itself as a love letter coming from a secret admirer. The worm could subsequently enter the Guinness Book of World Records because the foremost “virulent” What exactly allowed it to purpose this an honest deal damage, and the way did it paintings?

The virus originated in the Philippines and was created by two programmers, Onel De Guzman and his friend, Reonel Ramones. It was allegedly developed by taking other pieces of malicious software found online and putting them all together. The success of the virus relied on Visual Basic Scripting, commonly seen as a .vbs file, and the gullibility of non-tech savvy computer users, who used Windows’ new feature of hiding file extensions by default. The brand-new OS, Windows 2000, was the first version of Windows to implement this change. The option to hide file extensions goes all the way back to Windows 95, but users had to turn this on voluntarily.

Microsoft made this change to increase convenience for their end users, but as a result, also created the golden opportunity for malware developers. This was something that they could greatly take advantage of, and here’s how: Recipients of the ILOVEYOU worm would receive an email from someone in their Microsoft Outlook contact list, reading as follows: “kindly check the attached LOVELETTER coming from me.” The actual worm was listed as an attachment, and the name of the file shows exactly how the creators carried this out. Although the file ends in .vbs, the extension .txt is delusively added to the file name. When average Windows 2000 users downloaded this file, it would appear as only “.txt” on the desktop, giving the impression that it was a genuine text file.

This alone is why the virus mostly affected computers with Windows 2000, but earlier versions like 95 and 98 could still get infected, as those who didn’t hide file extensions and saw the .vbs at the end just chose to ignore it. The moment the file was actually opened, it would perform the following tasks:

Make multiple copies of itself, some of them hiding in parts of the directory, and others replacing and hiding personal files such as .mp3’s,. jpg’s, and other script types. 

Modify Windows registry keys. Send itself to everyone in your email contact list. Create a file called WIN-BUGSFIX.EXE, which would steal passwords from the user, despite its misleading name. The worm’s ability to cause mass destruction was also attributed to its design. Being a visual basic script, it was super easy for a user to access the source code and do whatever they wanted to with it.

While ILOVEYOU was not the first email worm, it made some big changes from previous ones that would cause it to be the most recognized. A similar virus from the year before known as Melissa, would mass mail itself to the first 50 people in your contact list. ILOVEYOU would send it everyone, allowing it to spread exponentially. Guzman and Ramones were arrested and promptly investigated by Philippines’ National Bureau of Investigation. It was revealed that Guzman had been working on a program designed to steal passwords for his college thesis.

When it was rejected, he dropped out. ILOVEYOU was very similar to this program, and was likely created as a pastime project, as Guzman claimed that he may have released the worm unintentionally. Since there were no official anti-malware laws at the time, all charges were dropped, and Guzman and Ramones were released scot-free. Antivirus laws were created immediately after, allowing the nefarious doings of ILOVEYOU to remain as an infamous part of computer history. So, I am going to be doing a demonstration of how the virus actually works. This was made possible by YouTube user Dan O-O-C-T 1,  I highly suggest you check him out. This will be a very similar demonstration, but I, nonetheless, wanted to try this out for myself.

It is currently Friday, May 5, 2000. On my computer, I am running Windows 2000, and on my desktop, I have included some files for the virus to overwrite. I have an audio file which is completely functional, and just a standard image.

I am going to open my Microsoft Outlook and check my email. Looks like I have something in my inbox. Well, this looks interesting. “kindly check the attached love letter coming from me.” I guess someone wants to share some undisclosed feelings that they have about me. Let’s go ahead and download that. As you can see, if I turn off the default setting to hide file extensions, the .vbs is here very clearly, but since I have it turned on, I have no idea. This is just an ordinary text file, and I’m curious to see what’s inside.

As you can now see, everyone in my contact list has now been sent a copy of this script. In addition, the files that I showed you earlier, have now been overwritten. They’re gone. Even if I revert it back to the original file extension, nothing.

You can probably see why this was such an issue for businesses, as important files would be permanently erased, and could only be recovered from a backup, if they were so lucky. As mentioned earlier, this virus would only hide some files rather than overwrite them, specifically audio files. As you can see, our mp3 is perfectly fine, just locked away. So, if you were a music producer, you had a much easier way out of this.

Remember when I told you that this virus was known for being easily modifiable?

Well, I will show you just how simple it is to access the source code. All you have to do is right click and select “Edit,” the rest is at your fingertips. Many other programmers who were also emailed the virus could send out their own version, and that’s exactly what they did. Some of them showed absolutely no mercy, and rather than destroying files, destroyed the entire operating system. If we replace is, and jse with “exe” and “com,” these files will be replaced with the worm.

Let’s go ahead and restart, shall we?

Thank you so much for watching,