Academy
Historical caseWindowsEmail worm
DR-NOS-02

ILOVEYOU

On 4 May 2000, an email with the subject line “ILOVEYOU” started in Manila and reached Hong Kong, Europe and the United States the same day. The attached VBScript sent itself to everyone in the Outlook address book, overwrote files on local disks and network shares, and downloaded a password-stealing program.

The UK House of Commons shut down its mail servers for two hours on 4 May. In the United States, the Departments of Justice and Labor, the Social Security Administration, the CIA and the Department of Defense were among the affected agencies.

Email wormVBScriptSocial engineeringOutlookmIRC2000

Activity map

Activity mapAttachmentDouble-clickDCCOpenReplacedDouble-clickExecutionOutlookDownloadEmailSubject: ILOVEYOUVBSTXT.vbs attachmentDouble extensionmIRC channelNew channel memberHTMHTM fileFile received over DCCNetwork driveShared folderJPGholiday.jpg.vbsReplaced with a copywscript.exeWindows Script HostILOVEYOUVBScript wormAddress bookAll contactsMass mailingOne message per contactStart pageOne of four addressesEXEWIN-BUGSFIX.exePassword stealerMP3OverwritingLocal and network drives
Executable payloadFile
Malicious payloadILOVEYOU · VBScript worm

When run, it copies itself to the system folder as MSKernel32.vbs and Win32DLL.vbs and adds itself to the Registry to run at every startup.

MITRE ATT&CK
T1547.001Registry Run Keys / Startup Folder
Appears in flows

Spread by country

Step 1 / 5
4 May 2000, morningFirst send
  • The worm began spreading from Manila. Its author had written the first version to run only in Manila and then removed that restriction.
  • The local service provider Sky Internet removed the pages distributing WIN-BUGSFIX.exe the same day and worked with the FBI on the investigation.

WiredCNET

Computers infected in the first 24 hours
10–45 million
Estimated economic damage
$3–15 billion
Recorded variants
More than 25
First seen
4 May 2000
01

Overview

ILOVEYOU is a VBScript worm that exploited the trust users placed in a “love letter” attachment from someone they knew. Because Windows hid known file extensions, the attachment appeared as LOVE-LETTER-FOR-YOU.TXT, a harmless text file.

The worm did not spread by a single route. Email was the main channel; it also sent files to people joining mIRC chat channels and replaced files on network shares with copies of itself. A colleague who opened a “photo” in a shared folder restarted the infection.

Its author, Onel de Guzman, had written a thesis at AMA Computer College in Manila proposing a program to steal internet access passwords; the college rejected the proposal. In 2020 he told journalist Geoff White that he wrote the worm and that the first version was restricted to run only in Manila.

Also known as: Love Bug, Love Letter, VBS/LoveLetter

02

Timeline

  1. Before 2000Onel de Guzman submitted a thesis to AMA Computer College proposing a program to steal internet access passwords; the college rejected the proposal. CNN
  2. 4 May 2000The worm began spreading from Manila and reached Hong Kong, Europe and the United States the same day. ZDNET
  3. 4 May 2000The House of Commons mail servers were shut down for two hours. Sky Internet removed the WIN-BUGSFIX.exe pages. CNN
  4. 8 May 2000An apartment in Manila was raided and diskettes were seized. CERT/CC reported more than 500,000 affected systems. CERT/CC
  5. 11 May 2000De Guzman attended a press conference with his face covered; his lawyer answered most of the questions. Wikipedia
  6. 18 May 2000The US General Accounting Office (GAO) presented its report on gaps in inter-agency alerting and coordination to Congress. US GAO
  7. June 2000The Philippines passed an electronic commerce law with penalties for computer crimes. The law was not retroactive and could not be applied to the case. Wikipedia
  8. 21 August 2000All charges were dropped because the evidence collected did not support the charges in the case file. CBS News
  9. May 2020De Guzman, working as a phone repairman in Manila, told Geoff White that he wrote the worm. BBC News
03

Infection chain

  1. 1

    Infection

    • The recipient receives a message with the subject “ILOVEYOU” from someone in their address book.
    • The same file can also arrive over DCC in a mIRC channel or as a modified file on a network share.
    T1566.001Spearphishing AttachmentT1534Internal SpearphishingT1080Taint Shared Content

    Where it breaks today: Attachments with script extensions are blocked at the gateway; unusual attachments from internal accounts are scanned too.

  2. 2

    Execution

    • The user double-clicks LOVE-LETTER-FOR-YOU.TXT.vbs, thinking it is a text file.
    • Windows Script Host runs the script; the worm removes the script time limit in the Registry.
    T1036.007Double File ExtensionT1204.002Malicious FileT1059.005Visual BasicT1112Modify Registry

    Where it breaks today: File extensions are kept visible; users are prevented from running scripts with Windows Script Host.

  3. 3

    Persistence

    • Copies named MSKernel32.vbs and Win32DLL.vbs are left in the system folder.
    • Both copies and the downloaded WIN-BUGSFIX.exe are added to the Registry to run at startup.
    T1547.001Registry Run Keys / Startup Folder

    Where it breaks today: A script or a file from a user folder being added to Run keys raises an alert in endpoint protection.

  4. 4

    Spread

    • It is sent once to every contact in every address book in Outlook.
    • A script.ini is created in the mIRC folder; the file is sent to everyone who joins the channel.
    T1087.003Email AccountT1534Internal SpearphishingT1105Ingress Tool Transfer

    Where it breaks today: An outbound mail rate limit and automatic file receiving turned off in clients break the chain here.

  5. 5

    Destruction and password theft

    • Files of certain types on local and network drives are replaced with the worm’s code.
    • If WIN-BUGSFIX.exe could be downloaded, passwords on the system are collected and sent by email.
    T1485Data DestructionT1555Credentials from Password StoresT1048.003Exfiltration Over Unencrypted Non-C2 Protocol

    Where it breaks today: Backups that keep version history recover the files; multi-factor authentication that also protects the session lowers the value of a stolen password.

04

File and Registry artifacts

TypeValuePurpose
Email attachmentLOVE-LETTER-FOR-YOU.TXT.vbsSubject “ILOVEYOU”, body “kindly check the attached LOVELETTER coming from me.”
File%System%\MSKernel32.vbsCopy that runs at startup.
File%Windows%\Win32DLL.vbsSecond copy that runs at startup.
Filescript.iniIn the mIRC folder; sends the file to anyone joining the channel.
FileLOVE-LETTER-FOR-YOU.HTMCopy sent over IRC.
FileWIN-BUGSFIX.exePassword stealer downloaded through Internet Explorer.
RegistryHKLM\…\CurrentVersion\Run\MSKernel32Persistence.
RegistryHKLM\…\CurrentVersion\RunServices\Win32DLLPersistence.
RegistryHKLM\…\CurrentVersion\Run\WIN-BUGSFIXPersistence of the downloaded program.
RegistryHKCU\…\Windows Scripting Host\Settings\TimeoutThe script time limit is removed.
RegistryHKCU\…\Internet Explorer\Main\Start PageChanged to the download address.
RegistryHKCU\Software\Microsoft\WAB\*Record of contacts the message was sent to.
05

Affected file types

ExtensionWhat happenedSource
.vbs, .vbeReplaced with the worm’s code.CERT/CC
.js, .jse, .css, .wsh, .sct, .htaReplaced with the worm’s code; the extension becomes .vbs (x.css → x.vbs).CERT/CC
.jpg, .jpegReplaced with the worm’s code; .vbs is appended (x.jpg → x.jpg.vbs).CERT/CC
.mp3, .mp2The original file is hidden and a copy named x.mp3.vbs is left next to it.CERT/CC
06

How it came to light

The worm was noticed not through analysis but through its own speed: as corporate mail servers filled with messages carrying the same subject line, email systems shut down one after another.

The script was unencrypted VBScript, so it was read within hours. Philippine service providers traced the link that first spread the worm to a phone line registered at an apartment linked to de Guzman.

No computer was found in the 8 May raid; the diskettes left behind led the investigation to other students at the same college. At the time the Philippines had no law defining computer crime, so prosecutors turned to a law on credit card fraud; the charges were dropped in August.

07

Who was affected

OrganizationCountryImpactSource
House of CommonsUnited KingdomMail servers were shut down for two hours.CNN
Banking systemBelgiumFinancial institutions were affected.US GAO
Departments of Justice and Labor, Social Security AdministrationUSAffected along with most federal agencies.US GAO
CIA, Department of DefenseUSOperations were affected.US GAO
US ArmyUS2,258 workstations; $79,200 cost.US Army
Veterans Health AdministrationUS7 million messages; 240 person-hours of cleanup.US GAO
NASAUSSome files could not be recovered from backup.US GAO
08

By the numbers

MeasureValueSource
Systems reported by the evening of 8 MayMore than 500,000 (650 organizations)CERT/CC
Computers infected in the first 24 hours10–45 millionEBSCO Research Starters
Share of internet-connected computersAbout 10%Wikipedia
Estimated economic damage$3–15 billion (2020s estimate ~$10 billion)WTOP / AP
Recorded variantsMore than 25Wikipedia
09

Relevance today

ILOVEYOU showed that trust in “an attachment from someone you know” was enough on its own. Today the same trust is exploited with invoices and sharing links sent from compromised corporate mailboxes.

The goal has changed: staying quiet instead of deleting files. Today’s infostealers finish what WIN-BUGSFIX tried to do, collecting the passwords, cookies and sessions in the browser within minutes and putting them up for sale.

Lumma StealerAn infostealer spread through fake verification pages and email attachments.Malware IntelligenceMalware families active today.
10

Sources

  1. 1CERT Advisory CA-2000-04: Love Letter Worm · CERT/CC, 2000
  2. 2“ILOVEYOU” Computer Virus Highlights Need for Improved Alert and Coordination Capabilities · US GAO, 18 May 2000
  3. 3“ILOVEYOU” Virus: Lessons Learned Report · US Army, 2003
  4. 4‘ILOVEYOU’ e-mail worm invades PCs · ZDNET, 2000
  5. 5Philippine ISP cooperating with FBI in virus probe · CNET, 4 May 2000
  6. 6Love Bug Suspect Off The Hook · CBS News, 21 August 2000
  7. 7How a badly-coded computer virus caused billions in damage · CNN, 2020
  8. 8The 20-Year Hunt for the Man Behind the Love Bug Virus · Wired, 2020
  9. 9Love Bug’s creator tracked down to repair shop in Manila · BBC News, 2020
  10. 10I love you: How a computer virus caused billions in damage · WTOP / AP, 2020
  11. 11ILOVEYOU virus attacks computers · EBSCO Research Starters
  12. 12ILOVEYOU · Wikipedia
Article details
Category
Case analysis
Type
Email worm
First seen
4 May 2000
Tags
  • Email worm
  • VBScript
  • Social engineering
  • Outlook
  • mIRC
  • 2000

More cases

11–12 February 2001Email worm (VBScript)Anna KournikovaIn February 2001, an email attachment claiming to be a photo of tennis player Anna Kournikova flooded mail servers across Europe and North America within hours. The worm had been made with a “worm generator” kit that required no coding skills. Its damage stayed far below ILOVEYOU, but it spread almost as fast.Read more 2008–2009Worm, botnet agentPalevo (Mariposa botnet)In 2009, MSN Messenger users received short messages such as “is this you on pic?” with a photo link from their friends. The link was not a photo but the Palevo worm. The Mariposa botnet built with Palevo controlled around 12.7 million computers in more than 190 countries when it was taken down in December 2009.Read more August 2008Social network worm, botnetKoobfaceIn 2008, Facebook and MySpace users received a video link from their friends. The video would not play and said a Flash Player update was required. The download was Koobface: a worm that used the hijacked account to send the same message to the whole friend list, collected credentials and sold fake antivirus. The group behind it was publicly identified only in 2012.Read more

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

View productCompare plans