The ILOVEYOU Virus (2000): How One Email Attachment Hit Millions of Computers

The subject line was one word, really, with no spaces: ILOVEYOU. Inside was a short, slightly odd message asking the reader to check an attached love letter that supposedly came from the sender. Millions of people opened it. Within about a day, it had become one of the most destructive computer outbreaks the world had ever seen.

It wasn't built by a government or a criminal gang. By most accounts it began as a clumsy script written by a student in Manila who wanted free internet access. That mismatch between the simplicity of the trick and the size of the damage is what makes the story worth telling, and why it still matters every time an unexpected attachment lands in your inbox.

The email that looked like a crush

The message arrived on 4 May 2000 with the subject ILOVEYOU. The attachment was named LOVE-LETTER-FOR-YOU.TXT.vbs. Read that quickly and you see a text file. Read it slowly and you see a second extension at the end, .vbs, which marked it as a Visual Basic script, a small program that Windows would happily run.

So why did nobody notice? Because at the time, Windows hid the extensions of file types it recognised by default. The .vbs part simply wasn't shown, leaving only LOVE-LETTER-FOR-YOU.TXT on the screen. A plain text file can't do any harm, so people felt safe. The setting that hides extensions is still switched on by default in Windows today, which is worth knowing.

The bait did the rest. Nobody wants to ignore a message that says someone loves them. And because the email appeared to come from a colleague, a friend or a boss, curiosity won over caution.

What happened after the click

Opening the attachment ran the script, and the script got busy. Reports of the time and later analyses describe several things happening in quick succession:

• It mailed itself onward. The worm sent a copy of itself to everyone in the Outlook address book on that computer. Each new victim became a fresh source of infected mail, sent from an address the next person knew.
• It damaged files. It overwrote files on the machine, including documents, images and music, replacing them with copies of itself.
• It went after passwords. A second component was designed to steal passwords, which investigators later linked to the author's original goal.
• It spread through chat. It also altered files used by the IRC chat program, so that people who joined a chat with an infected user could be sent the worm too.

One small note on vocabulary. People called it a virus, and the name stuck, but it's usually classified as a worm: a program that spreads by itself, from computer to computer, without needing a person to pass it along on purpose. We untangle the difference in our post on ransomware vs. viruses.

Following the sunrise around the world

The spread has a satisfying shape, almost like a wave. It began in Asia during working hours, and then moved west as each region's offices opened and people sat down at their desks.

Part of the reason it moved so fast was the way companies ran email back then. Many ran their own mail servers inside the building, and nearly everyone used the same software. When a server was flooded, the only practical response was to unplug it, which is exactly what many organisations did. People remember it as a day when email, quite suddenly, simply stopped.

How big was it, really?

Figures for old outbreaks are rough, and they don't always agree. It's best to treat all of these as estimates rather than facts carved in stone.

Notice the third row. The headline numbers were less about stolen money and more about lost working hours. Thousands of IT teams spent days scrubbing systems, and every hour of that adds up when you multiply it across the planet.

Who wrote it, and what happened to him?

Investigators traced the worm to Manila, in the Philippines, and Onel de Guzman, a young computer student, was widely identified as its author. Accounts that have been published over the years say he was short of money and struggling to pay for dial-up internet access, and that the password-stealing part was meant to let him log in to other people's accounts for free. His lawyer told reporters at the press conference that he hadn't understood what the consequences would be.

The legal ending was anticlimactic. At that time, the Philippines had no law against writing and releasing malware, and prosecutors dropped the charges that August. A new e-commerce law was passed later in 2000 covering this kind of offence, but the country's constitution doesn't allow laws to be applied backwards, so it couldn't be used against him.

People still argue about how much he intended. Whatever the answer, the lesson is the same: code written to solve a small, selfish problem can behave in ways its author never planned, once it's loose on a connected world.

Why it worked so well

It's tempting to say people were careless. That's not quite fair. The worm exploited a perfectly human mix of things:

• Emotion. A message about love gets opened before it gets examined.
• Trust. The email arrived from someone you knew, because it was sent from their account without their knowledge.
• A disguise. The hidden file extension made a program look like harmless text.
• Monoculture. Nearly everyone used the same mail program and operating system, so a trick that worked on one machine worked on millions.
• Powerful software. The mail client and operating system let an attachment run a script and reach the address book with little resistance.

What changed afterwards

ILOVEYOU wasn't the first email worm. The Melissa virus the year before had also used Outlook address books to spread, and some people see ILOVEYOU as the moment the world really took the lesson on board. Over the following years, mail software and mail servers gradually began to block or warn about risky attachment types by default, antivirus tools learned to hunt for this kind of script, and companies started treating email security as a real discipline instead of an afterthought. Laws against computer crime also caught up in many countries.

But the trick underneath it, an emotional message from a seemingly trusted sender with something to open, never went away. Today it wears a different costume: a fake invoice, a "shared document" link, a delivery notice. If you'd like to see what that looks like now, our walkthrough of how a disposable email can help against phishing takes apart a modern example.

What it still teaches us

• Be wary of attachments you weren't expecting, even from people you know. If the sender's account has been hijacked, the message looks genuine because it technically is.
• Make your computer show full file names. In Windows File Explorer you can turn on the option to display file name extensions, so a .vbs or .exe can't pretend to be a text file.
• Treat scripts and executables as dangerous. A document shouldn't ever need you to run anything.
• Keep backups. The costliest part of this outbreak was restoring damaged files.
• Keep software updated and use security software that checks attachments before you open them.
• Don't scatter your real address around. It won't stop a friend's infected account from writing to you, but every list your address sits on is another place for unwanted and unsafe mail to start. A separate throwaway address for signups, as we describe in the rise of email spam and how to fight back, keeps that smaller.

A love letter nobody wanted

Twenty-odd years on, ILOVEYOU feels almost quaint. The graphics, the software and the scale of the internet have all changed. But the central idea was as modern as anything we see today: someone found a way to make a message feel personal, and people responded the way people do. The next time an attachment from a familiar name makes you curious, pause for three seconds. That small habit is cheaper than any antivirus.

Sources

• ILOVEYOU - Wikipedia
• The not-so lovable computer virus that changed cybersecurity forever - IT Brew
• How a computer virus caused billions in damage and exposed vulnerabilities for decades - WTOP
• Throwback Attack: ILOVEYOU, a love letter no one wanted - Control Engineering
• The ILOVEYOU Worm, A Global Crisis - Purdue TAP