TECHNOLOGY ALERT from The Wall Street Journal at WSJ.com.

May 4, 2000

A computer virus carried by e-mail messages bearing the title "I Love You" quickly spread around the world, wiping out important computer files and forcing large corporations to shut down their e-mail systems.

FOR MORE INFORMATION, see: Link

-- Flash (flash@flash.com), May 04, 2000

Answers

Better Link

I Love You' E-Mail Virus Attacks Computer Systems World-Wide

Fast-Moving Virus Attacks Picture, Music Files; Some Firms Stop Spread by Taking Down E-Mail

A computer virus carried by e-mail messages bearing the title "I Love You" quickly spread around the world Thursday, wiping out important computer files and forcing large corporations to shut down their e-mail systems.

By WSJ.com reporters David Pringle in London, Jeanette Borzo in Paris and Scott Eden in New York

Japanese investment bank Nomura, and telephone firms Cable & Wireless PLC and British Telecommunications PLC were among the major companies to have had their computers infected by the virus. On Wall Street, investment banks took drastic steps early Thursday to stop the virus in its tracks.

White House Spokesman Jake Siewert said the White House computer systems are unaffected by the virus but there are reports coming in from various federal agencies that the virus is cropping up there.

The Love Letter virus, which is transmitted by e-mail, can locate and wipe out picture and music files on a recipient's computer. The virus also can change a user's Web browser settings, automatically sending a user to a site from which the virus is downloaded, once the user boots up the browser and logs on to the Internet.

Finnish computer security firm F-Secure Corp. says that more than 1,000 clients around the world have contacted it about the virus since 7 a.m. GMT (2 a.m. EDT) Thursday morning. And more than 100,000 of its clients' machines had been infected, the security firm said.

"At one big media company all the picture archives for the past two years have been deleted," said Mikko Hypponen, manager of antivirus research at F-Secure in Espoo, Finland.

Fastest-Spreading Ever?

Mr. Hypponen says that the Love Letter virus seems to be replicating much faster than the infamous Melissa virus, which spread around the world in March of 1999. He predicts that the virus will wreak havoc Thursday and Friday, "But we estimate the situation will be calmed down by Monday," he added.

Much like the Melissa virus, which tied up global e-mail systems last year, the I Love You virus targets users of Microsoft Corp.'s Outlook e-mail program. Hidden in an e-mail attachment, the worm virus replicates if the message is opened and prompts Outlook to send infected messages to every user in the mail program's address book.

The virus then searches for music and picture files on the users' hard disk and overwrites them.

"It's not pretty," said Ross Wilson, the Singapore-based Southeast Asia director of Symantec Corp., a U.S.-based company that makes antivirus software. "It's got the capability of spreading very, very quickly."

Many experts believe the virus originated in the Philippines, because the word "Manila" is included in the original e-mail. The original message comes from the e-mail address ispyder@mail.com. It also declares "I hate to go to school."

Hectic Morning on Wall Street

For U.S. workers, many were met with warnings about the virus as they came to work. The virus had started toward the end of the Asian business day, spread to Europe and was already seen as a big threat by the time Wall Street opened for business Thursday.

A Bear Stearns spokesman said: "We did get hit. It's not a debilitating attack. It's more of a nuisance." He said the company has segmented its servers to curtail the spread, but employees can send and receive outside e-mail. "Outside communication is not affected." He added that the company feels the virus is isolated and is being dealt with.

Companies in the Asia-Pacific region were the first to be hit, with Hong Kong firms reporting virus outbreaks Thursday afternoon local time. The virus appeared to target public-relations firms and investment banks in particular.

A person at Credit Lyonnais Securities (Asia) said the brokerage house shut down its outgoing mail server 11 minutes after receiving the virus to prevent it from going any further.

In Singapore, Citibank's e-mail system was shut down as the bank was flooded with the message, but the extent of the damage wasn't known, according to a person familiar with the situation. The bank has sent out a regional alert on the virus.

Dow Jones & Co.'s Dow Jones Newswires and The Asian Wall Street Journal offices in Asia also were among its victims.

Taking a Long Lunch

The virus spread in Europe as well.

In Paris, staff at the Organization for Economic Cooperation and Development first heard about the bug from its help desk. Warned not to open any messages titled, ILOVEYOU, many OECD staff took an early lunch to avoid tangling with the virus which has been popping into OECD mailboxes.

"We can keep working on documents that were open [when the virus arrived] but we can't send anything out and we can't send messages internally either," says Helen Fisher in the OECD's media relations department. "Because so much of what we do is communications with the outside world, it seemed like a good time to go to lunch."

"The good thing -- if there can be a good thing -- is that this happened just before lunch so it gave us some time to work with the problem," said Lester Rodriques, head of the OECD's client services division in Paris. The organization shut down its e-mail system quickly and this afternoon was investigating the damage.

"It is a extremely malicious virus," Mr. Rodriques said. "One of the malicious things it does is lodge itself in several places on your system and on the network ... . It replaces the contents of some files with the virus." At the OECD. Windows DLL files and Visual Basic scripts were the most frequently damaged, he said.

In Denmark, the parliament, telecom company Tele Danmark, channel TV2 and the Environment and Energy Ministry all were affected. "We have no clue how it got in," said Hugo Praestegaard of the Environment and Energy Ministry.

At Computer!Totaal, the Dutch version of PCWorld magazine, software editor Remco de Graaf said the virus "first showed up at about 11 this morning. One person opened it, which sent around the virus to all the people on his contact list."

The virus tried to modify JPEG picture files, MP3 audio files and other files on users' machines, as well as on the seven-server network used by 120 employees at the Haarlem, Netherlands-office of IDG Communications Netherlands. IDG publishes Computer!Totaal and other computer magazines such as InfoWorld the Netherlands. The company had to shut down its mail server to stop the spread of the virus.

To combat the virus, IDG is using Love Cleaner from Teq International. "It's a temporary fix" that disables the virus, said Mr. De Graaf, who expects Teq to post a more complete virus fix later in the day.

Viruses are something of a cottage industry on the Web, where there are sites that allow users to inspect existing viruses and create new ones. While spreading harmful viruses is a federal crime, authors of viruses are seldom, if ever, caught.

Viruses often spread via e-mail, and last year's Melissa outbreak, which affected more than 1.2 million computers in North America alone, served as a wake-up call for to people who manage corporate computer systems to tighten security and install tougher firewalls to prevent new attacks.

--The Associated Press contributed to this article.

-- Flash (Flash@flash.hq), May 04, 2000.

I can't get on Yahoo this morning. Anyone else having that problem?

-- Lars (lars@indy.net), May 04, 2000.

Lars,

I haven't noticed a problem getting on to Yahoo Finance this morning. I just tried the main Yahoo menu at 09:50 PDT and it came right up.

-- Flash (flash@flash.hq), May 04, 2000.

"Major Computer Virus Outbreak-Not a Hoax"

http://hv.greenspun.com/bboard/q-and-a-fetch-msg.tcl?msg_id=0035bk

-- The other thread (about@this.virus), May 04, 2000.

Flash,

Thanks for your reply. I still can't get on Yahoo. I called my ISP and they said Yahoo is down. Maybe it's a regional thing.

-- Lars (lars@indy.net), May 04, 2000.