Hello everyone. It is May 4th, 2012.
And it's time for another anniversary malware video.
And this time we are looking at the infamous Love Letter worm from the year 2000 -- twelve years ago.
So, twelve years ago today it began wreaking havoc
and showing up all over the world
eventually causing over $5.5 billion dollars in damage
due to its somewhat destructive nature
and also high modability.
So,
as you can see, it would arrive on your system
as "LOVE LETTER FOR YOU.TXT".
It would seem to be coming from a friend
since it uses your out- Outlook uh, contacts to send itself...
so, you would probably trust this
you'd be interested to see why your friend was
professing his or her love to you.
But, if you look at it, it is actually just the worm
and it's just in plain text here, not encrypted or anything
and if we change the standard Windows option to hide file extensions,
you'll see it ends in VBS not TXT, so it is a script.
So, we have a few test files here that will be over-written
by the original variant of the worm.
We have a JPEG file screenshot from the game FreeSpace 2,
we have an MP3 from Descent 1.
Pretty cool.
And then we have an HTA file "Hello World",
a VBS script "Hello World".
Uh, just a blank VBE file
Oh.
Delete the .TXT extension, it doesn't do anything.
And then also another blank JS file that doesn't do anything.
So we will go ahead and run the worm
and see what happens.
So as you can see, mass mails itself to your contacts
If you look at it, subject is "ILOVEYOU"
"kindly check the attached LOVELETTER coming from me"
and it's the same for all of these.
So, it will email itself to all your contacts
which allowed it to spread very quickly
and while it does that... well, you know,
maybe we should disable Shared Folders in virtual PC, for just a moment...
So it doesn't over-write all my Shared folder files
That's a good idea.
So anyway,
as you can see, it has over-written a lot of these
except for the VBE file for some reason...
See, our MP3 file is now the worm.
MP3, .VBS, JPEG, .VBS,
it just over-wrote the JS file, didn't even keep the old file extension.
Test VBS .VBS...
it's just the worm again...
So,
we should be able to see that it has dropped a few files
I think if you notice that you have a file called "LOVE LETTER FOR YOU .TXT .VBS",
in your Windows system file,
that it's not actually a love letter...
that's just me.
And, if we refresh the Windows folder...
it also dropped itself here...
if we scroll down quite a bit...
Where is it?... There it is.
132 .DLL .VBS, also the worm.
So, it drops itself to quite a few places on your fold- on your computer...
and, if we look, it didn't actually over-write your MP3s
unlike all the other folder-...files
'scuse me.
We show it made the original MP3 hidden
So, [Descent 1 music plays]
You can still play it, and everything. All your MP3s are safe
but it just over-wrote the filename
and hid the original.
So you'd have to know that in order to recover your MP3s
but all the other files that it had over-written are lost.
So...
I don't know why we're stuck on this cursor, but whatever.
Anyway, due to its easily... modified nature, you can look down
you can change a lot of things about this
and there were hundreds of variants of people doing just this.
So, we can make these incredibly destructive by changing JS to EXE to be over-written
Or, JSE to COM
so now those files will be over-written instead.
And then, it has some MIRC spreading routines
and then, if we scroll down here,
here is the mail routine.
We can change it to say anything... "this is a worm".
So, when we run it again
it'll now over-write all these files...
if we refresh, we should see them, it has begun
yes, as you can see, a lot of VBS files have been written
to the system.
So, restarting would probably be a bad idea
but that's half the fun of these videos
so, we're going to go ahead and restart the computer.
And, it should not boot.
If it restarts... there it goes.
And... nope!
It's been over-written it will not boot.
So you'd have to re-install Windows if you got hit with a variant like this
since they can be incredibly destructive.
So, that is about it for the Love Letter worm on it's twelfth anniversary.