a computer
worm written in
Microsoft's visual basic scripting that originated in
May 2000 in the Philippines.
It spread by sending itself by email to all of the contacts of an infected machine, the original variant with subject "ILOVEYOU" and contents "kindly check the attached LOVELETTER coming from me." The
key to its success was a false file extension; as the attachment was named "LOVE-LETTER-FOR-YOU.TXT.vbs", most
people would assume it was an innocuous text file as the true extension would be hidden by default. The machine would become infected as
soon as the attachment was opened.
On an infected machine, the script would copy its contents into two trojans on key
windows directories, and
add itself to run on startup. It changed the IE home page to a site from which to download a trojan, named "WIN-BUGSFIX.exe," which was likely used to steal passwords. The most harmful payload of all was its replication scheme. The original variant would copy its contents into all other image, script and audio files in any directory and append the ".vbs" extension to their
name so that they would turn into duplicates of the malware and their original contents would be lost
forever (except for mp3s, which were hidden instead). Other variants were made to overwrite system files too.
The creator of the malware, Onel De Guzman, was eventually caught. The malware was estimated to have caused billions in damage.
