ILOVEYOU

The ILOVEYOU worm was coded by Onel de Guzman, a former student at AMA Computer College in the Philippines. At the time of its creation, de Guzman was poor and struggling to pay for the country's dial-up internet access. De Guzman believed that internet access was a human right, He reasoned that this would allow users to be able to afford an internet connection, arguing that those affected by it would experience no loss. ultimately dropping out of the college to begin developing the worm. == Architecture ==

De Guzman wrote ILOVEYOU in VBScript, and the Windows Script Host is utilized to run the code. ILOVEYOU was distributed through malicious email attachments. The worm was found in emails with the subject "ILOVEYOU" and a message of "kindly check the attached LOVELETTER coming from me." The attachment LOVE-LETTER-FOR-YOU.TXT.vbs contained the worm. Upon opening the file, the worm copies itself into relevant directories and modifies the Windows registry so it will be run upon reboot of the computer. Two of the three copies masquerade as legitimate Microsoft Windows library files, named MSKernel32.vbs and Win32DLL.vbs. The other copy retains the original LOVE-LETTER-FOR-YOU.TXT.vbs name. The worm also removes a 10 second timeout for scripts set in the windows registry, so execution can continue indefinitely. since its email encouraged potential victims to open the infected attachment under the pretext they had a lover who was attempting to contact them. The worm's use of its previous victim's address book further incentivized recipients to comply, as emails appeared to come from close contacts. The worm's subsequent success has resulted in the use of social engineering in many modern-day malware attacks. Over 25 variants of the ILOVEYOU worm have been recorded. Variants exhibited a variety of behaviours that differed from the original worm, such as changing which file extensions were affected, modifying the email subject (sometimes to target a specific audience) and changing the worm's author credit. A notable variant of ILOVEYOU was NewLove, which was especially destructive since it targeted every file on the victim's hard drive until their computer stopped working and evaded antivirus software. Despite widespread coverage of this variant by media outlets, it failed to cause significant damage. == Spread ==

Originally designing ILOVEYOU to only work in Manila, de Guzman removed this geographic restriction, which allowed the worm to spread worldwide. thereafter moving westward through corporate email systems as employees began their workday moving first to Hong Kong, then to Europe, and finally the United States. Whole networks were compromised through a singular attachment access by any one user. Email systems had to be shut down due to the volume of incoming mail sent by the worm. The worm affected numerous financial institutions, including the banking system of Belgium. The Veterans Health Administration received 7,000,000 ILOVEYOU emails during the outbreak, requiring 240 man-hours of work to resolve the problems created. Files at the National Aeronautics and Space Administration were damaged, and in some cases unrecoverable from backups. == Investigations ==

Local internet service provider Sky Internet took down web pages delivering the WIN-BUGSFIX.exe trojan. Further investigations by ISPs linked the malware to a phone line associated with an apartment belonging to de Guzman's sister. De Guzman's mother warned him of the worm's public attention and hid his computer, but left behind floppy disks containing malware that unintentionally implicated other students from AMA Computer College. A police raid on 8 May 2000 led to the seizure of these disks and the arrest of De Guzman's sister's boyfriend. The Philippines' National Bureau of Investigation was unsure of what felonies could apply since there were no specific laws against hacking in the Philippines at the time. All charges against De Guzman were later dropped by prosecutors, since the evidence collected did not support what had been filed. 2019 interview of de Guzman De Guzman's last known public appearance was at a press conference on 11 May 2000, where he obscured his face and allowed his lawyer to answer most questions; his whereabouts remained mostly unknown afterward. In April 2019, investigative journalist Geoff White visited the Quinta Market in Manila to look for de Guzman, following a tip off from an internet forum. He discovered de Guzman working at a mobile phone repair stall elsewhere in Manila. De Guzman admitted to creating and releasing the worm, and cleared all others who had been accused of co-authoring it. White later published his findings in his cybercrime book, Crime Dot Com (2020). == Aftermath ==

ILOVEYOU has repeatedly been named as one of the most destructive and virulent pieces of malware in history. Within ten days of the first reported cases, tens of millions of infections had been reported, and it is estimated that 10% of Internet-connected computers in the world were eventually affected. however estimates in the 2020s place this figure between US$10 to $15 billion. Since this law was passed after the worm's release, de Guzman could not be prosecuted retroactively under it. Cultural impact The events inspired the song "E-mail" on the Pet Shop Boys' UK top-ten album of 2002, Release. "I love you [rev.eng]" exhibited in July 2006 is a revamped and expanded version of an exhibition shown in June 2002 in the Museum for Applied Art in Frankfurt, in February 2003 at transmediale in Berlin, in August 2004 at the Watson Institute of the Brown University USA and in October 2004 at the Museum for Communication Copenhagen, Denmark. In 2009, Kiat Kiat Projects curated an email exhibition entitled "How to Prevent Hair Loss" inspired by ILOVEYOU. The worm inspired the 2011 movie Subject: I Love You starring Jericho Rosales and Briana Evigan. In 2019, The Persistence of Chaos, a laptop infected with six viruses including ILOVEYOU was sold at auction by Chinese artist Guo O Dong. In November 2024, The Museum of Malware Art in Helsinki, Finland included a sculpture about ILOVEYOU. == See also ==