Home | Site Map | Search | Contacts
NISER > News > How the I LOVE YOU Virus Works

How the I LOVE YOU Virus Works
8th May 2000 (Computimes)

The I LOVE YOU virus, which rapidly spread through the Internet last week, may have erased files from its victims computers, but the more widespread damage may have been in clogging up computer networks.

An analysis of the computer code showed that while the virus does indeed delete files from personal computers, it multiplies itself quickly, sending duplicates via e-mail and a program used to access Internet Relay Chat, a text based online messaging system. Because the virus accesses and sends copies of itself to everyone in a victim's e-mail address book, it literally clogs up the Internet with junk mail, much like a plumbing clog, grinding everything to a halt.

"The real damage in clogging things up", said Scott Culp, a security manager at Microsoft Corp. 'it really shows how viruses are more of a social phenomenon, because we're finding that people who really know beter went ahead and opened it when they saw the 'I love you'". The virus only targets users running Microsoft Windows operating system, attacking the Outlook e-mail program and the Internet Explorer browser, both of which are made by Microsoft.

The victim activates the virus by opening the e-mail, then clicking on the attachment inside. Opening the e-mail o its own does not activate the program. Once activated, the program accesses pieces of the Windows operating system, essentially turning on the parts of of Windows it needs to spread. First, it opens the Internet Explorer Web browser and attempts to download more virus code from one of four different web sites. The downloaded code is then used to obtain passwords from the user's computers.

Those web sites were quickly deactivated last Thursday morning, essentially breaking that part of the virus. Then, the virus attacks the victim computer's hard drive, deleting video and digital photography files and hiding music files. Next, it starts replicating itself. The virus uses code stolen from a piece of free software called mIRC, used to access Internet Relay Chat. That virus is then received by other chatters on IRC and can be activated if they click on it.

Finally, it goes into Microsoft Outlook's address book and creates e-mail duplicates of itself, sending the virus to everyone in the address book. If the user has the e-mail-to-fax function activated, the virus is sent via fax, though the program is actually printed out as computer code, which presents no danger to the fax machine.

The best defence, experts said, is to simply leave any unusual or unknown attachments unopened. Instead of clicking on them, just delete the entire e-mail.


Disclaimers and copyright information