Viruses: The Next Generation

When Love Came to Town

Here's a look at how the LoveLetter virus reached 55 million computers and how authorities tracked the outbreak to its origin. (Dates and times are EDT.)

May 3, 2000: The LoveLetter virus is released in the Philippines. Soon after, Sky Internet, a Philippine ISP, notices thousands of infected computers dialing in to four hosted Web pages to get a Trojan horse posted by the virus writer. The company removes the suspect Web pages.

The virus arrives as an attachment to an e-mail titled "I Love You." In addition to grabbing the Trojan horse, it sends itself to everyone in the user's Microsoft Outlook address book, and deletes or overwrites JPEG and MP3 files.

May 4, 4:12 a.m.: Symantec and other antivirus vendors start to work on a definition for the new virus.

7 a.m.: Most antivirus vendors have definitions available, but it's already too late for the U.S. East Coast, where workers have begun to open their e-mail.

10 a.m.: Investigators discover that LoveLetter's author left his nickname (Spyder), his e-mail address, and the name of his hometown in the source code. He also identified himself as a member of a programmer's group known as GrammerSoft.

4 p.m.: The first LoveLetter variant appears, with "Very Funny Joke" replacing "I Love You" in the e-mail's subject line.

6:40 p.m.: At least 20 countries have reported infections.

May 5: Nine variants of the virus have appeared. Amateur sleuths, including a Stockholm grad student named Frederik Bjorck, search newsgroups using keywords found in the virus. Bjorck finds similar viruses posted by Spyder four months earlier, including a version that identifies the author as a "student of amacc mkt. Phils," an abbreviation for the AMA Computer College in suburban Manila.

May 8: After identifying the phone number and computer from which the virus was sent, local authorities raid the apartment where they believe Spyder resides. Police find no computer, but they seize a disk containing a virus similar to LoveLetter.

May 11: Authorities question Onel de Guzman, who lives in the apartment. He admits he may have released the virus accidentally, but denies writing it.

June 29: The Philippines has no antivirus law, so de Guzman is charged under a law that usually applies to credit card theft.

August 21: Authorities conclude that the credit card law cannot be applied in this case and reluctantly drop charges.