# VIRUS ALERT-I LOVE YOU **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [May 4, 2000, 2:58pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556 "2000-05-04T14:58:02Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Kiki](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@Kiki](https://boards.straightdope.com/u/Kiki)\ **Post date:** [May 4, 2000, 5:01pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/21 "2000-05-04T17:01:08Z")
This virus is spreading all over my work. I work for an insurance company and we have offices and sub offices in every county in the State of Kansas. This virus is being sent to everyone because of our global distribution lists. I’ve received about 20 of them so far this morning. Like JohnLarrigan said, disable the Preview Pane or Auto Preview in your Outlook! I wish they would catch the creep who created this virus and throw his ass in jail for about 20 years. Think of all the time and money being wasted because people’s e-mail systems are down and so is the productivity and communication. It’s throwing my work off because I can’t communicate with people in the offices outside of my county! What a pain in the ass! ---
**Author:** ![Mr.Cynical](https://avatars.discourse-cdn.com/v4/letter/m/ee59a6/32.png) [@Mr.Cynical](https://boards.straightdope.com/u/Mr.Cynical)\ **Post date:** [May 4, 2000, 5:02pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/22 "2000-05-04T17:02:25Z")
Incidentally, do you think it would have spread faster if it had been called IKISSYOU? ---
**Author:** ![USCDiver](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/uscdiver/32/354_2.png) [@USCDiver](https://boards.straightdope.com/u/USCDiver)\ **Post date:** [May 4, 2000, 5:06pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/23 "2000-05-04T17:06:15Z")
New warning from computer services…don’t reboot if you get infected. It apparently only makes it worse…more as I get it. ---
**Author:** ![KimKatt](https://avatars.discourse-cdn.com/v4/letter/k/ac91a4/32.png) [@KimKatt](https://boards.straightdope.com/u/KimKatt)\ **Post date:** [May 4, 2000, 5:15pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/24 "2000-05-04T17:15:50Z")
> [@](#): > > \*\* > Does anybody know the deal with Symantec. In the news reports they say “Anti-virus firm Symantec said it had already released an update to its software to combat the virus, but warned computer users not to open any ``I love you’’ messages.” But the virus definition is not on my computer (and I get the updates regularly). Plus when I go to symantec’s site they say “Virus Definitions for VBS.LoveLetter.A pending.” > > Huh? > \*\* Yeah. The news is jumping the gun again. As of a few minutes ago, Solomon’s (Computer Associates) claims to have virus definitions for it, but Symantec does not. It does delete image files and MP3, among others, overwriting them with a similarly named VB file. It writes to your registry, causing it to run each time your computer is rebooted. Therefore, if you reboot, it resends itself to your address book again. ---
**Author:** ![Treycal](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@Treycal](https://boards.straightdope.com/u/Treycal)\ **Post date:** [May 4, 2000, 5:16pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/25 "2000-05-04T17:16:07Z")
Everyone is saying that it targets MS Outlook. Is it as potent in Outlook Express? I run Outlook Express at work and received the message this morning. I didn’t open it, but had my preview pane active and I saw the text of the message. I deleted it as soon as I got it, but I am a little worried now. ---
**Author:** ![curious\_george](https://avatars.discourse-cdn.com/v4/letter/c/b487fb/32.png) [@curious\_george](https://boards.straightdope.com/u/curious_george)\ **Post date:** [May 4, 2000, 5:30pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/26 "2000-05-04T17:30:37Z")
I heard it deletes files from your hard drive, also. All files? A few files chosen at random? Anybody know? ---
**Author:** ![tanstaafl](https://avatars.discourse-cdn.com/v4/letter/t/ba8739/32.png) [@tanstaafl](https://boards.straightdope.com/u/tanstaafl)\ **Post date:** [May 4, 2000, 5:30pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/27 "2000-05-04T17:30:52Z")
Well, I’ll weigh in with another major company hit. Our Outlook server has been down since about 9 this morning, but we were already heavily infected by then. Some people are reporting over 100 copies in their inbox. It got our companywide e-mail list and sent it to everyone. My Outlook Express access to my ISP mail is still up and I haven’t seen any copies of the message there. Maybe my ISP is filtering it upstream. Or, maybe nobody loves me. ☹ ---
**Author:** ![Silo](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@Silo](https://boards.straightdope.com/u/Silo)\ **Post date:** [May 4, 2000, 5:36pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/28 "2000-05-04T17:36:26Z")
This virus can go through firewalls too. I don’t know how? ---
**Author:** ![Falcon](https://avatars.discourse-cdn.com/v4/letter/f/49beb7/32.png) [@Falcon](https://boards.straightdope.com/u/Falcon)\ **Post date:** [May 4, 2000, 5:36pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/29 "2000-05-04T17:36:39Z")
Yeppers, my company got it too. Most people knew not to open the attachment, so we’re okay so far. Symantec hasn’t released the patch yet…our network admin said he’d tell us when they had. However, our OTHER network admin sent this out, and I thought it might be helpful for the Teeming Millions: Hi everyone, If you get this virus at home and need to clean it off here is the procedure. Note that once the antivirus software folks have a fix, it is probably better to use theirs, but this is the down and dirty way to get it done. 1. Do a find files for the word “love” (no quotes) and delete all the files you find. 2. Do a find files for \*.vbs on your local hard disks. delete the following: mskernel32.vbs and win32dll.vbs. Make sure that they have the file extension of vbs as there are critical system files with the same name, just a different three letter extension. 3. Go to start —\> Run. Then type regedit into the popup window. Go to edit —\> Find, and type in MSkernel32.vbs, and click the “Find Next” button. delete any entries that the progam finds. After deleteing the first entry press F3 to continue the search. When you get a message that the system has finished searching the registry, reboot the PC. 4. You are now clean. If you get an error while trying to delete the files, perform step three, reboot and re-do steps one and two. ---
**Author:** ![Joe\_Cool](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@Joe\_Cool](https://boards.straightdope.com/u/Joe_Cool)\ **Post date:** [May 4, 2000, 5:36pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/30 "2000-05-04T17:36:40Z")
I personally am getting a big laugh out of this. Windows Security = Oxymoron. 🙂 I think we’re seeing the death throes of Windows, and it’s going to happen because they have wood for embedded programming languages and macros. ActiveX, VBScript, VBA, all of this stuff is bad bad bad. You don’t need a full-featured programming language in your e-mail client. This thing could be better than the Morris Worm. 🙂 And I applaud whoever did it. Funny aside to this whole thing: my company’s network is down worldwide, from what I can tell. ---
**Author:** ![Joe\_Cool](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@Joe\_Cool](https://boards.straightdope.com/u/Joe_Cool)\ **Post date:** [May 4, 2000, 5:38pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/31 "2000-05-04T17:38:25Z")
P.S. Psycat, we love you too. ---
**Author:** ![soulsling](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@soulsling](https://boards.straightdope.com/u/soulsling)\ **Post date:** [May 4, 2000, 5:42pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/32 "2000-05-04T17:42:40Z")
anyone getting it on a mac? or with outlook express? ---
**Author:** ![MagicalSilverKey](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@MagicalSilverKey](https://boards.straightdope.com/u/MagicalSilverKey)\ **Post date:** [May 4, 2000, 5:56pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/33 "2000-05-04T17:56:18Z")
Thanks for the warning. I am blocking **all** of my mail until this blows over. ---
**Author:** ![Sofa\_King](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@Sofa\_King](https://boards.straightdope.com/u/Sofa_King)\ **Post date:** [May 4, 2000, 6:03pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/34 "2000-05-04T18:03:32Z")
Here’s some information and preliminary fixes. Please, do yourself a favor, read all of the links below, and consider carefully before taking matters into your own hands. It is possible that an undelete program will be created soon that will fix this problem for you. [http://www.thepope.org/index.pl?node\_id=140](http://www.thepope.org/index.pl?node_id=140) [http://www.tech-report.com/](http://www.tech-report.com/) [http://www.teq-international.com/](http://www.teq-international.com/) –note that these do not address the huge list of files it overwrites or hides, unless they have been updated. The files it overwrites are files that end in these extensions: .mp2 .mp3 .vbs .vbe .js .jse .css .wsh .sct .hta .jpg .jpeg As I said, there may be an undelete program out that will fix these, so you might want to sit tight before you flush all that porno. ---
**Author:** ![Olentzero](https://avatars.discourse-cdn.com/v4/letter/o/90ced4/32.png) [@Olentzero](https://boards.straightdope.com/u/Olentzero)\ **Post date:** [May 4, 2000, 6:12pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/35 "2000-05-04T18:12:23Z")
Well, our office has been lucky. We were destined to migrate from Lotus cc:Mail to MSOutlook today, which is being done; so nobody had access to e-mail. We just got notification from the LAN that FAA HQ had shut down the server due to this fun little bug but as far as I know nobody here got hit with it. (Hi lachesis! K Street Doper here… 🙂 ) ---
**Author:** ![SeaDiver](https://avatars.discourse-cdn.com/v4/letter/s/82dd89/32.png) [@SeaDiver](https://boards.straightdope.com/u/SeaDiver)\ **Post date:** [May 4, 2000, 6:27pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/36 "2000-05-04T18:27:06Z")
we are just now getting warnings about it at work. Thanks for the heads-up. ---
**Author:** ![Sofa\_King](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@Sofa\_King](https://boards.straightdope.com/u/Sofa_King)\ **Post date:** [May 4, 2000, 6:32pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/37 "2000-05-04T18:32:38Z")
I have one report that says .jpg, .jpeg, .mp3 and .mp2 files are merely emulated. The virus gives itself an identical name with the extension .vbs tacked on at the end, perhaps in the hope that it will mistakenly be clicked on. Hey, Olentzero, can you hear that wailing noise coming from due west? I can hear it from DuPont. It’s the sound of half a million IT people cursing over in Fairfax. ---
**Author:** ![lachesis](https://avatars.discourse-cdn.com/v4/letter/l/848f3c/32.png) [@lachesis](https://boards.straightdope.com/u/lachesis)\ **Post date:** [May 4, 2000, 6:35pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/38 "2000-05-04T18:35:17Z")
> [@](#): > > \*\* > Well, our office has been lucky. We were destined to migrate from Lotus cc:Mail to MSOutlook today, which is being done; so nobody had access to e-mail. We just got notification from the LAN that FAA HQ had shut down the server due to this fun little bug but as far as I know nobody here got hit with it. (Hi lachesis! K Street Doper here… 🙂 ) > \*\* / hijack! / howdy from Crystal City, over/under 95 from the Puzzle Palace. once on a time i worked around 17th & K. first gov’y job was at DOT. / end hijack / and our Outlook is still squashed. not sure if it’s crossed into all DOD yet, but if _we’ve_ already been infested, i’d say it’s nearly inevitable. brings a Heinlein quote that was a sig (on my other list) to mind: _“When in trouble or in doubt Run in circles, scream and shout”_ ---
**Author:** ![SkySlash](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@SkySlash](https://boards.straightdope.com/u/SkySlash)\ **Post date:** [May 4, 2000, 6:39pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/39 "2000-05-04T18:39:06Z")
I just made the decision to shut down my division’s external data communications. It hit our email servers about an hour ago and took out two of my Exchange Servers… Frckin bastards…I wanted to do other things today…not this. We’re about to take our entire system offline and scan the whole thing for .vbx extensions… SONOFABITCH… -SS ---
**Author:** ![Joe\_Cool](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@Joe\_Cool](https://boards.straightdope.com/u/Joe_Cool)\ **Post date:** [May 4, 2000, 8:15pm UTC](https://boards.straightdope.com/t/virus-alert-i-love-you/18556/40 "2000-05-04T20:15:45Z")
First off, this IS NOT A VIRUS. It’s a worm. All it does is replicate itself quickly. Unfortunately, a side effect of the rapid replication is that servers get flooded. Here is the official BUGTRAQ write-up: * * * A quick update with some more information and quick fixes. I am reproducing my original message in full bellow as some people are filtering messages with a subject line of ILOVEYOU. There is a good description of how to disinfect a system manually at [http://www.thepope.org/index.pl?node\_id=140](http://www.thepope.org/index.pl?node_id=140) [skyinet.net](http://skyinet.net) seems to be off the net. It seems they are being blackholed by someone. The worm has a comment that may or may not indicate the author: rem barok -loveletter(vbe) \ rem by: spyder / [ispyder@mail.com](mailto:ispyder@mail.com) / @GRAMMERSoft Group / Manila,Philippines I did not make it clear, but the worm does infect files in mapped network drives, so it can spread across the network via file shares by infecting the files I reported. When someone opens those files the worm will execute and infect their system. It seems the WIN-BUGFIX.exe file will email any cached passwords to MAILME@SUPER.NET.PH. To stop the spread download updates for your antivirus product for your vendor. They all have some type of fix by now, but most antivirus vendor websites seems to be unavailable under the high load. Some I could reach: NAI: [http://download.mcafee.com/extrafiles/love-4.zip](http://download.mcafee.com/extrafiles/love-4.zip) Datafellows: [http://www.datafellows.com/download-purchase/updates.html](http://www.datafellows.com/download-purchase/updates.html) TrendMicro: [http://www.antivirus.com/download/pattern.asp](http://www.antivirus.com/download/pattern.asp) Sophos: [http://www.sophos.com/downloads/ide/index.html#loveleta](http://www.sophos.com/downloads/ide/index.html#loveleta) You should also not open visual basic attachments in email (.VBS), not accept DCC’s on IRC from strangers (or friends for that matter) unless you known what you are receiving. If you control your mail server you should try to configure it to stop messages with attachments ending in .vbs. There seems to be some patches to sendmail from when Melissa came out that does this. You may also want to filter all email going out to MAILME@SUPER.NET.PH and stop the download of WIN-BUGFIX.exe in your HTTP proxy. - Elias Levy ([aleph1@SECURITYFOCUS.COM](mailto:aleph1@SECURITYFOCUS.COM)) [000504 17:02]: \> A new VB worm is on the loose. This would normally not be bugtraq \> material as it exploits no new flaws but it has spread enough that it \> warrants some coverage. This is a quick and dirty analysis of what it does. \> \> The worm spreads via email as an attachments and via IRC as a DCC download. \> \> The first thing the worm does when executed is save itself to three \> different locations. Under the system directory as MSKernel32.vbs and \> LOVE-LETTER-FOR-YOU.TXT.vbs and under the windows directory as \> Win32DLL.vbs. \> \> It then creates a number of registry entries to execute these programs \> when the machine restarts. These entries are: \> \> HKEY\_LOCAL\_MACHINE\Software\Microsoft \Windows\CurrentVersion\Run\MSKernel32 \> HKEY\_LOCAL\_MACHINE\Software\Microsoft \Windows\CurrentVersion\RunServices\Win32DLL \> \> It will also modify Internet Explorer’s start page to point to a web page \> that downloads a binary called WIN-BUGSFIX.exe. It randomly selects between \> four different URLs: \> \> [1](http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe) \> [2](http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe) \> [3](http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe) \> [4](http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe) \> \> I’ve not been able to obtain copy of the binary to figure out what it does. \> This does mean the worm has a dynamic components that may change its \> behavior any time the binary is changed and a new one downloaded. \> \> The worm then changes a number of registry keys to run the downloaded binary \> and to clean up after itself. \> \> HKEY\_LOCAL\_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX \> HKEY\_CURRENT\_USER\Software\Microsoft\Internet Explorer\Main\Start Page \> about:blank \> \> The worm then creates an HTML file that helps it spread, \> LOVE-LETTER-FOR-YOU.HTM. This is the file DCC’ed to others on IRC. \> \> The worm then spreads to all addresses in the Windows Address Book by \> sending the file LOVE-LETTER-FOR-YOU.TXT.vbs as an attachment. The \> email starts: \> \> kindly check the attached LOVELETTER coming from me. \> \> Then the virus searches for attached drives looking for files with \> certain extensions. It overwrites files ending with vbs, and vbe. \> It overwrites files ending with js, jse, css, wsh, sct, and hta, and \> then renames them to end with vbs. It overwrites files ending with jpg \> and jpeg and appends .vbs to their name. It finds files with the name \> mp3 and mp3, creates vbs files with the same name and sets the hidden \> attribute in the original mp\* files. \> \> The it looks for the mIRC windows IRC client and overwrites the script.ini \> file if found. It modifies this file to that it will DCC the \> LOVE-LETTER-FOR-YOU.HTM file to any people that join a channel the \> client is in. \> \> You can find the source of the worm at: \> \> [here](http://www.securityfocus.com/templates/archive.pike?list=82&msg=3911840F.D7597030@thievco.com&part=.1) \> \> – \> Elias Levy \> [SecurityFocus.com](http://SecurityFocus.com) \> [http://www.securityfocus.com/](http://www.securityfocus.com/) \> Si vis pacem, para bellum – Elias Levy [SecurityFocus.com](http://SecurityFocus.com) [http://www.securityfocus.com/](http://www.securityfocus.com/) Si vis pacem, para bellum **[Edited to fix overly long lines.]** [Previous page](https://boards.straightdope.com/t/virus-alert-i-love-you/18556.md?page=1) [Next page](https://boards.straightdope.com/t/virus-alert-i-love-you/18556.md?page=3)