Analysis of the ILOVEYOU Worm.pdfVIP

May 9, 2000 Analysis of the ILOVEYOU Worm Matt Bishop Department of Computer Science University of California at Davis Davis, CA 95616-8562 email: bishop@ On May 4, 2000, many computer users found a letter with the subject ILOVEYOU , The worm instructed the reader to click on an attachment to see a love letter. Those who did spread a worm to the users in their Outlook address books, and introduced a pass- word-grabbing program onto their systems that was invoked at the next reboot. This worm was particularly virulent. In a few hours, it had spread worldwide. Among the institutions affected were the British Parliament, the United States Congress, the United States Air Force, and innumerable businesses and organizations. Most anti-virus vendors had signatures out within 24 hours, and several mailing lists described how to filter electronic mail to block any incoming instances of electronic mail containing the worm. Unfortunately, the nature of the filtering was not comprehensive, and copycat worms with differing subject lines slipped through. The seriousness of the problem increased as a variant informed people that about $300 had been charged to their credit card for a Mothers Day present, and they could click o