CERT Advisory CA-2000-04 Love Letter Worm

Original release date: May 4, 2000
Last revised: May 9, 2000
Source: CERT/CC

A complete revision history is at the end of this file.

Systems Affected

Systems running Microsoft Windows with Windows Scripting Host enabled

Overview

The "Love Letter" worm is a malicious VBScript program which spreads in a variety of ways. As of 5:00 pm EDT(GMT-4) May 8, 2000, the CERT Coordination Center has received reports from more than 650 individual sites indicating more than 500,000 individual systems are affected. In addition, we have several reports of sites suffering considerable network degradation as a result of mail, file, and web traffic generated by the "Love Letter" worm.

I. Description

You can be infected with the "Love Letter" worm in a variety of ways, including electronic mail, Windows file sharing, IRC, USENET news, and possibly via webpages. Once the worm has executed on your system, it will take the actions described in the Impact section.

Electronic Mail

When the worm executes, it attempts to send copies of itself using Microsoft Outlook to all the entries in all the address books. The mail it sends has the following characteristics:

An attachment named "LOVE-LETTER-FOR-YOU.TXT.VBS"
A subject of "ILOVEYOU"
The body of the message reads "kindly check the attached LOVELETTER coming from me."

People who receive copies of the worm via electronic mail will most likely recognize the sender. We encourage people to avoid executing code, including VBScripts, received through electronic mail regardless of the sender without firsthand prior knowledge of the origin of the code.

Internet Relay Chat

When the worm executes, it will attempt to create a file named script.ini in any directory that contains certain files associated with the popular IRC client mIRC. The script file will attempt to send a copy of the worm via DCC to other people in any IRC channel joined by the victim. We encourage people to disable automatic reception of files via DCC in any IRC client.

Executing Files on Shared File Systems

When the worm executes, it will search for certain types of files and replace them with a copy of the worm (see the Impact section for more details). Executing (double clicking) files modified by other infected users will result in executing the worm. Files modified by the worm may also be started automatically, for example from a startup script.

Reading USENET News

There have been reports of the worm appearing in USENET newsgroups. The suggestions above should be applied to users reading messages in USENET newsgroups.

II. Impact

When the worm is executed, it takes the following steps:

Replaces Files with Copies of the Worm

When the worm executes, it will search for certain types of files and make changes to those files depending on the type of file. For files on fixed or network drives, it will take the following steps:

For files whose extension is vbs or vbe it will replace those files with a copy of itself.
For files whose extensions are js, jse, css, wsh, sct, or hta, it will replace those files with a copy of itself and change the extension to vbs. For example, a file named x.css will be replaced with a file named x.vbs containing a copy of the worm.
For files whose extension is jpg or jpeg, it will replace those files with a copy of the worm and add a vbs extension. For example, a file named x.jpg will be replaced by a file called x.jpg.vbs containing a copy of the worm.
For files whose extension is mp3 or mp2, it will create a copy of itself in a file named with a vbs extension in the same manner as for a jpg file. The original file is preserved, but its attributes are changed to hidden.

Since the modified files are overwritten by the worm code rather than being deleted, file recovery is difficult and may be impossible.

Users executing files that have been modified in this step will cause the worm to begin executing again. If these files are on a filesystem shared over a local area network, new users may be affected.

Creates an mIRC Script

While the worm is examining files as described in the previous section, it may take additional steps to create a mIRC script file. If the file name being examined is mirc32.exe, mlink32.exe, mirc.ini, script.ini, or mirc.hlp, the worm will create a file named script.ini in the same folder. The script.ini file will contain:

[script]

n0=on 1:JOIN:#:{
n1=  /if ( $nick == $me ) { halt }
n2=  /.dcc send $nick DIRSYSTEM\LOVE-LETTER-FOR-YOU.HTM
n3=}

where DIRSYSTEM varies based on the platform where the worm is executed. If the file script.ini already exists, no changes occur.

This code defines an mIRC script so that when a new user joins an IRC channel the infected user has previously joined, a copy of the worm will be sent to the new user via DCC. The script.ini file is created only once per folder processed by the worm.

Modifies the Internet Explorer Start Page

If the file \WinFAT32.exe does not exist, the worm sets the Internet Explorer Start page to one of four randomly selected URLs. These URLs all refer to a file named WIN-BUGSFIX.exe, which presumably contains malicious code. The worm checks for this file in the Internet Explorer downloads directory, and if found, the file is added to the list of programs to run at reboot. The Internet Explorer Start page is then reset to "about:blank". Information about the impact of running WIN-BUGSFIX.exe will be added to this document as soon as it is available.

Sends Copies of Itself via Email

The worm attempts to use Microsoft Outlook to send copies of itself to all entries in all address books as described in the Description section.

Modifies Other Registry Keys

In addition to other changes, the worm updates the following registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX
HKCU\Software\Microsoft\Windows Scripting Host\Settings\Timeout
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\WAB\*

Note that when the worm is sending email, it updates the last entry each time it sends a message. If a large number of messages are sent, the size of the registry may grow significantly, possibly introducing additional problems.

III. Solution

Update Your Anti-Virus Product

It is important for users to update their anti-virus software. Some anti-virus software vendors have released updated information, tools, or virus databases to help prevent and combat this worm. A list of vendor-specific anti-virus information can be found in Appendix A.

Disable Windows Scripting Host

Because the worm is written in VBS, it requires the Windows Scripting Host (WSH) to run. Disabling WSH prevents the worm from executing. For information about disabling WSH, see:

http://www.sophos.com/support/faqs/wsh.html

This change may disable functionality the user desires. Exercise caution when implementing this solution.

Disable Active Scripting in Internet Explorer

Information about disabling active scripting in Internet Explorer can be found at:

http://www.cert.org/tech_tips/malicious_code_FAQ.html#steps

This change may disable functionality the user desires. Exercise caution when implementing this solution.

Disable Auto-DCC Reception in IRC Clients

Users of Internet Relay Chat (IRC) programs should disable automatic reception of files offered to them via DCC.

Filter the Worm in E-Mail

Sites can use email filtering techniques to delete messages containing subject lines known to contain the worm. For sites using unix, here are some possible methods:

Sendmail

Sendmail, Inc. has published information about blocking the worm in incoming email at:

http://www2.sendmail.com/loveletter

PostFix

Add the following line in /etc/postfix/header_checks:

/^Subject: ILOVEYOU/ REJECT

The main Postfix configuration file must contain the following line to enable the check :

header_checks = regexp:/etc/postfix/header_checks

Postfix must also be reloaded after this information is added.

Exim

A generic Windows-executable content-blocking filter has been produced for Exim. This will block messages with attachments whose extensions are vbs, as well as several other types that Windows may consider executable by default. The filter, which includes some supporting installation documention within the filter file itself, can be found at:

ftp://ftp.exim.org/pub/filter

Procmail

This procmail rule also deletes any messages with the Subject: line containing "ILOVEYOU":

   :0 D
   * ^Subject:[[tab] ]+ILOVEYOU
   /dev/null

Note that in all of these examples, [tab] represents a literal tab character, and must be replaced with a tab for them to work correctly.

It is important to note that these three methods, as described, do not prevent the worm from spreading if the Subject: line of the email has changed. Administrators can use more complicated procmail rules to block the worm based on the body of the email, but such methods require more processing time on mail servers, and may not be feasible at sites with high volumes of email traffic.

Exercise Caution When Opening Attachments

Exercise caution with attachments in email. Users should disable auto-opening or previewing of email attachments in their mail programs. Users should never open attachments from an untrusted origin, or that appear suspicious in any way.

Appendix A. Anti-Virus Vendor Information

Appendix B. Variants

The CERT Coordination Center has received reports of worms that are nearly identical or are very similar to the Love Letter worm. The information provided above applies to these variants except as noted below. This section is not intended to be comprehensive, and we are aware of reports involving additional variants not described here.

Joke / Very Funny

This variant changes several references to LOVE-LETTER-FOR-YOU in the source code to Very Funny. This primarily results in an email attachment name Very Funny.vbs. The email messages sent by this variant have a subject of "fwd: Joke", and an empty message body.

Mothers Day

The subject of this variant is "Thanks for your purchase!" and the body of the message contains:

We have proceeded to charge your credit card for the amount of $326.92 for the mothers day diamond special. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place. Thanks Again and Have a Happy Mothers Day!

This variant infects files as previously described, with the exception of jpg and jpeg files. Instead, this variant infects ini and bat in a similar way. Specifically, for files whose extension is ini or bat, it will replace those files with a copy of the worm and add a vbs extension. For example, a file named x.ini will be replaced by a file called x.ini.vbs containing a copy of the worm.

This variant also includes different URLs for the Internet Explorer Start Page.

The CERT Coordination Center thanks David Slade of Lucent Technologies for help in constructing this advisory; Christopher Lindsey for the providing the procmail rule; and Jeff Rife for catching an error in an earlier version of this advisory.

The following people were involved in the creation of this document: Jeff Carpenter, Cory Cohen, Chad Dougherty, Ian Finlay, Kathy Fithen, Rhonda Green, Robert Hanson, Jeff Havrilla, Shawn Hernan, Kevin Houle, Brian King, Jed Pickel, Joseph Pruszynski, Robin Ruefle, John Shaffer, and Mark Zajicek

This document is available from: http://www.cert.org/advisories/CA-2000-04.html

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

To subscribe to the CERT mailing list for advisories and bulletins, send email to majordomo@cert.org. Please include in the body of your message

subscribe cert-advisory

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Conditions for use, disclaimers, and sponsorship information

Revision History

May 4, 2000:  Initial release
May 5, 2000:  Updates to Postfix information
May 5, 2000:  Fixed an error in the statement regarding the actions 
of the worm when it checks for the existance of the
\WinFAT32.exe file.  We incorrectly
reported that if this file exists, then the value of the IE start page
will be changed.  In fact, the value of the start page is changed if
the file does not exist. Our thanks to Jeff Rife for catching
this error. 
May 5, 2000:  Added information on variants
May 9, 2000:  Updated affected site count
May 9, 2000:  Added EXIM information
May 9, 2000:  Clarified mIRC script description

Space shortcuts

Child pages