ILOVEYOU, the Love Letter the Whole World Opened

This one is history: I wasn’t even alive when it started spreading. The virus we’re talking about is ILOVEYOU, also called the Love Bug or VBS/LoveLetter. Some of you will find it oddly familiar, and I don’t blame you: it’s probably the most famous computer virus ever. It arrived as a love letter in your inbox, and the moment you opened it, it sent itself to everyone you knew.

The email

On May 4, 2000, people in the Philippines started receiving an email with the subject line “ILOVEYOU”. The message just said “kindly check the attached LOVELETTER coming from me.” and came with an attachment called:

LOVE-LETTER-FOR-YOU.TXT.vbs

That file name was the trick. Windows hides “known” file extensions by default, so most people saw LOVE-LETTER-FOR-YOU.TXT and thought it was a harmless text file. In reality it was a VBScript (.vbs) program, and Windows ran it as soon as you double-clicked it.

And it came from someone you knew: a friend, a coworker, your boss. Who wouldn’t open a love letter from someone they know? Because of the time zones, as the working day started in Asia, then Europe, then America on May 5, each region opened its email to find the worm waiting.

What happened when you opened it

• It mailed itself to your whole address book. Using Microsoft Outlook, it sent the same “ILOVEYOU” email to every contact in your address book, not just one. Each of them got a love letter from you, and if they opened it, the same thing happened from their PC.
• It overwrote some of your files. It replaced files of certain types with copies of itself, mainly images (JPG and JPEG) and script and web files (like VBS, JS and CSS). Your photos were gone, and every overwritten file was now another copy of the worm, waiting to be double-clicked.
• It hid your music. MP3 and MP2 files weren’t deleted but hidden, with copies of the worm put next to them.
• It spread through chat too. If you used the mIRC chat program, it changed its settings to send the worm to other people in the same chat channels.
• It tried to steal passwords. It changed Internet Explorer’s home page so it would download a password-stealing program, which would send saved passwords back to its author.
• It made itself start with Windows, copying itself into system folders and adding itself to the registry.

Ten days, tens of millions of PCs

Nothing like it had been seen before. Because every infected PC emailed everyone in its address book, the numbers grew exponentially. Within about ten days, estimates say tens of millions of computers were infected (figures range from around 10 million to over 45 million), often quoted as around one in ten of all computers connected to the internet at the time.

Offices were hit hardest, because that’s where everyone used Outlook and had huge address books full of coworkers. Email servers were flooded with millions of love letters, and many organisations simply switched their email off to stop it, including the Pentagon, the CIA, the British Parliament and big companies like Ford. The damage and clean-up costs were estimated at around $10 billion worldwide.

Who made it, and why he was never punished

Investigators quickly traced the worm to Manila and to Onel de Guzman, a 24-year-old student at AMA Computer College. Earlier, he had proposed a program that stole internet passwords as his thesis project. His college rejected it, saying it was illegal.

The strangest part of the story: he was never convicted. In 2000, the Philippines had no law against writing or spreading computer viruses, so the charges were dropped. The country passed one quickly afterwards, but laws can’t punish things done before they existed.

For twenty years he stayed silent. In 2020, BBC reporter Geoff White found him running a phone repair stall in Manila. De Guzman admitted he wrote it. He said his goal was to steal internet passwords, because he couldn’t afford to pay for internet access, and that he only meant to spread it to people in the Philippines. He never expected it to go around the world, and said he regretted the damage.

A simple script that played on feelings

Technically, ILOVEYOU wasn’t impressive. It was a short script that security researchers at the time described as badly written, and it didn’t use any clever security hole. What it exploited was people. Almost nobody can ignore a love letter, especially one from someone they know, and the “.TXT” in the name made it look like the safest kind of file there is. On top of that, in 2000 a script attachment was allowed to read your address book and send emails without asking you anything.

That’s why it’s still the textbook example of social engineering: tricking the person instead of the computer.

Could it happen today?

Not in the same way. After ILOVEYOU, Microsoft changed Outlook to block dangerous attachments like .vbs files and to warn you when a program tries to send email on your behalf. Email providers now scan attachments, antivirus detects these scripts instantly, and Microsoft announced in 2023 that it’s retiring VBScript from Windows altogether.

But the idea behind it never went away. Today’s phishing emails use the exact same tricks: a fake invoice, a “shared document” from a coworker, a package you didn’t order. The file types changed, the human weakness didn’t.

The one habit I’d take from this story: turn on file extensions. In File Explorer, go to View → Show → File name extensions, and something like .TXT.vbs or .pdf.exe becomes obvious straight away. And if an attachment you didn’t expect arrives from a friend, ask them before opening it. Their account might be the one sending it.