Quantcast
PCWorld.com is upgrading some back-end systems. Some site features, such as user registration, may be temporarily unavailable.
Subscribe to magazine

Viruses: The Next Generation

What will be the next virulent outbreak? No one knows, except that it's guaranteed to be more lethal than ever.

Kim Zetter

  • 0 Yes
  • 0 No

When Love Came to Town

Here's a look at how the LoveLetter virus reached 55 million computers and how authorities tracked the outbreak to its origin. (Dates and times are EDT.)

May 3, 2000: The LoveLetter virus is released in the Philippines. Soon after, Sky Internet, a Philippine ISP, notices thousands of infected computers dialing in to four hosted Web pages to get a Trojan horse posted by the virus writer. The company removes the suspect Web pages.

The virus arrives as an attachment to an e-mail titled "I Love You." In addition to grabbing the Trojan horse, it sends itself to everyone in the user's Microsoft Outlook address book, and deletes or overwrites JPEG and MP3 files.

May 4, 4:12 a.m.: Symantec and other antivirus vendors start to work on a definition for the new virus.

7 a.m.: Most antivirus vendors have definitions available, but it's already too late for the U.S. East Coast, where workers have begun to open their e-mail.

10 a.m.: Investigators discover that LoveLetter's author left his nickname (Spyder), his e-mail address, and the name of his hometown in the source code. He also identified himself as a member of a programmer's group known as GrammerSoft.

4 p.m.: The first LoveLetter variant appears, with "Very Funny Joke" replacing "I Love You" in the e-mail's subject line.

6:40 p.m.: At least 20 countries have reported infections.

May 5: Nine variants of the virus have appeared. Amateur sleuths, including a Stockholm grad student named Frederik Bjorck, search newsgroups using keywords found in the virus. Bjorck finds similar viruses posted by Spyder four months earlier, including a version that identifies the author as a "student of amacc mkt. Phils," an abbreviation for the AMA Computer College in suburban Manila.

May 8: After identifying the phone number and computer from which the virus was sent, local authorities raid the apartment where they believe Spyder resides. Police find no computer, but they seize a disk containing a virus similar to LoveLetter.

May 11: Authorities question Onel de Guzman, who lives in the apartment. He admits he may have released the virus accidentally, but denies writing it.

June 29: The Philippines has no antivirus law, so de Guzman is charged under a law that usually applies to credit card theft.

August 21: Authorities conclude that the credit card law cannot be applied in this case and reluctantly drop charges.

  • Recommend this story?
  • 0 Yes
    0 No
  • Great year-end deals
    for small business!

  • Get 24/7 live remote AT&T Tech Support 360* service along with select Lenovo* PCs (with Intel® Core™ 2 Duo processors) and save up to 200!

    Learn more

  • HP EliteBook* 6930p Notebook with Intel® vPro™ technology and a free HP Basic Docking Station - $641 instant savings!

    Learn more

  • *Other names and brands may be claimed as the property of others. ©2009 Intel Corporation. Intel, the Intel logo, vPro and Core trademarks of Intel Corporation in the United States and other countries. All rights reserved.

People who read this also read:

  • 15 Minutes to a Secure Business Get the Secure in 15 toolkit starting with the "15 Minutes Month-at-a-Glance" calendar. McAfee will send you additional tools and tricks to stay protected around the clock.
  • A Buyer's Guide to Data Protection Implementing data protection products and processes can be daunting. Make the right decisions by exploring what is available and what makes sense for your organization. Use this simple guide to evaluate different vendor offerings.

Sponsored Links