December 11, 2000, 10:25 AM — Computer systems around the globe continue to be struck today by the so-called "I
Love You" virus. Passing unnoticed through corporate firewalls as an email attachment,
the virus deletes critical systems files and infects others.
One victim had hundreds of file names appended with a ".vbs" extension. Another
victim's system was infected when accessing a server that had been previously infected.
According to Symantec Corp.'s Antivirus Research Center, the "VBS.LoveLetter.A" is an
extremely fast-spreading computer virus, of a type known as a worm, that uses mIRC and
Microsoft Outlook to email itself as an attachment.
Symantec's engineers report that VBS.LoveLetter.A appears as an attachment with the
subject line ILOVEYOU along with an attachment called LOVE-LETTER-FOR-YOU.TXT.vbs.
Tips on eradicating the virus
- From Symantec: The quick fix for now is for network or email
administrators to set a filter for the attachment name (LOVE-LETTER-FOR-YOU.TXT.vbs)
and subject line (ILOVEYOU) immediately.
- From a user suggestion: Reboot the infected PC and roll back to a previous
version of the Windows registry.
Antivirus vendors Symantec, McAfee, and Panda Software all expect to post remedies
to their Websites sometime today.
The Computer Emergency Response Team (CERT) Coordination Center at Carnegie Mellon
University in Pittsburgh said that it had received more than 150 reports of the virus
as of 10 a.m. ET today. Experienced managers at CERT said this is an unusually high
number of reports for an email virus.
The following information was obtained from the US military:
ILOVEYOU is a VBScript worm. It spreads through email as a chain letter. The worm uses
the Outlook email application to spread. LoveLetter is also a overwriting VBS virus,
and it spreads itself using mIRC client as well. When it is executed, it first copies
itself to Windows System directory as: