ILOVEYOU Virus Hits University Computers

A virus that has so far infected 45 million computers worldwide has circulated widely at Harvard, prompting Harvard Arts and Sciences Computer Services (HASCS) to issue warnings to users.

The ILOVE YOU virus damages infected computers by searching for files with certain extensions, including MP3s and jpeg files, and then overwriting them. The virus causes damage as it leaps from computer to computer.

The virus spreads as an attached file in e-mail messages with the subject line "ILOVE YOU." HASCS staffers are warning users to delete such attachments, even if the e-mail message comes from a friend.

"Many people received this virus from people they knew (because they were in the other person's address book), and so they opened it without knowing what it was. This is one of the aspects that has allowed this virus to spread so quickly," wrote Rick Osterberg '96, database applications specialist for the Faculty of Arts and Sciences' (FAS) Computer Services, in an e-mail message.

HASCS has posted electronic warnings about the virus on its website and newsgroup and has also put up paper versions around campus.

While computer viruses are prevalent, Osterberg said HASCS only issues warnings when a virus threatens to infect much of the campus.

"For the VBS/LoveLetter virus, we did experience a rather large infection rate on campus," Osterberg said.

According to the HASCS warning, computers that run graphical e-mail programs like Microsoft Outlook or Eudora on a Windows operating system are most susceptible to the virus.

However, HASCS warned that computers that cannot be infected with the virus could still pass it on.

"Even if your computer does not meet these criteria, you should erase e-mail with the above subject headings to minimize the possibility of sending the virus to others," the warning stated.

The ILOVE YOU virus spreads particularly quickly because it has the ability to send itself to every entry in the e-mail address book of infected computers. Last year's Melissa virus could only send itself to 50 address book entries.

This virus is also more destructive than previous programs because it copies itself into base computer systems files, allowing it to run every time an infected computer is started.

"VBS/LoveLetter virus is no hoax," Osterberg said. "It is an actual virus, with real-life destructive capabilities."

Yesterday, authorities identified a 23-year-old man in the Philippines as the suspected creator of the ILOVE YOU virus, after learning that the program could send stolen e-mail passwords to an address owned by the man.

According to CNN, the virus has infected 60 to 80 percent of U.S. companies, as well as several U.S. government agencies and more than 100,000 servers in Europe

Since the virus started spreading last Thursday, many copycat viruses have appeared that mimic the virus's behavior, including those with subject lines and file names like "Susitikim shi vakara kavos puodukui...", "FW: Joke", "Love Letter", "Very Funny.vbs" or "Very Funny.HTM."

Harvard has resources to help its affiliates deal with the ILOVE YOU virus.

"Students who are infected and need assistance should contact their local house or dorm User Assistant, or contact the Science Center Help Desk to schedule an appointment," said Osterberg.

Faculty and staff who experience damage from the virus should their local Information Technology Contact or the FASCS helpdesk.

"You should be suspicious of ANY e-mail attachments you receive, even those sent by people you know," the HASCS warning read.