Analysis of the I-LOVE-YOU virus

By Frans Faase

Below the text of the famous virus, interspersed with my comments. This is mainly to show that the virus does not contain all kinds of dirty tricks that the Anti-virus software people claim it to have. Especially the reproduction mechanism is dead simple. The only noteworthy thing about it, is that it contains a two step quine, because it can generate an HTML file, which can create the original virus text again.

The quality and style of the code differs from part to part, which seems to suggest that it is from the hand of more than one person. It almost looks like this virus was build from fragments of other virii. Some parts, like the procedure html are quite complicated to construct. Other parts contain typical beginners errors. There are fragments of useless code, and some functionality has been implemented more than once. I even found some small bugs. This is not a particularily well designed piece of code. My conclusion is that this virus was never intended to be anything more than a pratical joke. It is also not the most evil virus one can think of. It does some harm, but there are some simple modifications which would make it much more harmful.

I have taken the liberty to indent the code in order to improve readability.

Really silly to include the above lines if you want to stay anonymous. Now the real script starts with some declarations and initializations. The code below is all you need to read the script into the variable vbscopy, which is later on used in the subroutine infectfiles, the only nasty bit of the virus. To achieve this first a File System Object is created. This is a object which gives you easy access to the file system, and allows you to do every thing with what you want. In other word, you can do whatever you want. The object is stored in fso, and also used in the rest of the script. The first use of it is to open the script file itself in file. This variable is only used here. After this the main subroutine is called.

The main subroutine

Why this main subroutine is needed, is not completely clear to me, as you could have done without. It starts with the usual "resume on error" statement, and the necessary declarations. The first thing this routine does is setting the scripting time-out, which is stored in the registry. It surprises me that the routines regget and regcreate have not been used here. A typical sign of bad design: defining a function, and then not using it. Or was it because the author put the script together from other bits not fulling understanding the complete code? And why do you want to read the value, test if it is larger then zero, and then set it to zero. (I suspect this parameter can only be zero or positive.) The variable wscr is not used in the rest of the code, while CreateObject("WScript.Shell") is called many times more. Now get the names of all the important system folders. Now, the first part of the reproduction process starts. The script is copied to some often executed script files. As soon as the user starts any of these the whole infection process starts over again. Now call the other subroutines. Again it is questionable whether it would have been needed to subroutines here. To follow the execution trail, continue reading the description of the procedure regruns.

The subroutine regruns

This subroutine starts with the usual stuff. Now modify the registry, such that the two VBScript files that were overwritten will be run automatically, from now on everytime during startup of the computer. Set the Internet Explorer directory to "C:\", if it has not been set yet. The following piece of code is a little obscure. It looks like it has been stolen from somewhere else. It is namely the only part that uses the short hand "HKCU" for "HKEY_CURRENT_USER". The code is only executed if the user has a FAT32 file system, recognized by the presense of WinFAT32.exe To follow the execution trail, continue reading the description of the procedure html.

The subroutine listadriv

This subroutine starts the execution of the nasty part of the virus, which overwrites and renames script, picture, and music files. It basically calls the subroutine infectfiles for all the files on all the local drives. Hereby the subroutine folderlist is used to scan all folders recursively.

The first part of the subroutine (besides the usual things) retrieves a collection of all the drives by means of the File Sytem Object.

The following loop, calls folderlist for all the local drives. The following statement is very strange, as the variable s has not been assigned any value, and this is a subroutine, not a function. I would say that this line has been left over from some previous version of this subroutine (when it was still a function). Who knows?

The subroutine infectfiles

This the subroutine which infects files in the folder specified by the parameter folderspec. The subroutine is called from the subroutine folderlist. The subroutine starts with the usual things: Below follows the loop which traverse all the files in the directory. It gets the folder from the File System Object, and from this the collection of all files. The code below is executed for each file in the folder. First the file name (stored in s) and the extension (stored in ext) are retrieved in lower case. If the file has the extension vbs or vbe it is overwritten by a copy of this VBScript file. If the file has the extension js, jse, css, wsh, sct, or hta, it is first overwritten. These are all different kinds of scripting files. And secondly, it is renamed to file with the same name, but with the extension vbs. This is done by copying the file, to the file with the new name, and then delete the original file. If the file has the extension jpg or jpeg (picture files), it is overwritten with this VBScript file, and the file is renamed by adding the extension .vbs. If the file has the extension jpg or jpeg (picture files), it is overwritten with this VBScript file, and the two is added to the file attributes. Adding is a little a strange, it would have been correct to replace the "add" with an "or" operation. If the file is one of the files mirc32.exe, mlink32.exe, mirc.ini, script.ini, or mirc.hlp (indicating the presence of a mIRC program), the file script.ini is created (or overwritten). This script file is used by the Internet Relay Chat program mIRC, and will automatically try to send the earlier generate HTML file (by the subroutine html) to anybody joining a chat channel. The script starts with some comment lines telling you not to modify it, otherwise mIRC might corrupt Windows. The opposite is the case, I would say. Please note that the comment character ";" is missing from the third line. This will quite likely generate an error message whenever mIRC is started, and thus reveal that the file has been tampered with.

The subroutine folderlist

This routine will call itself and the subroutine infectfiles on all the folders in the folder specified by the parameter folderspec. It is called by either itself, or listadriv.

The subroutine regcreate

This is a little subroutine to add/modify the key specified by the parameter regkey with the value given in the parameter regvalue in the registry.

The subroutine regget

This is a little function to retrieve the value with the key specified by the parameter value (a rather misleading name).

The subroutine fileexist

This is a little function to test the existence of the file with name as specified in the parameter filespec. It has been programmed rather clumsy. Two lines would have been enough. Really this function is so small, that it would have been better to call the method FileExists directly, as is done in two places (here and here) of the code below.

The subroutine folderexist

This is a little function to test the existence of the file with name as specified in the parameter folderspec. For this function the same remarks can be made as the previous. However, this subroutine is not called anywhere. It is a piece of dead code. (I discovered this when I used chkhtml to check this file.)

The subroutine spreadtoemail

This is the reproduction subroutine. It sends an email with this file as an attachment to all people in the address book of Outlook. This is the part that makes it a virus. Really nothing tricky happens here. It used "male" for "mail", and "malead" for "mail-id". Was it written by someone with a limited knowledge of English or was this done on purpose.

The subroutine starts with the usual stuff.

Creat a shell object that will give access to the windows registry. I do not understand why the global variable wscr is not used in this subroutine instead. Now create a connection with the Outlook application. Outlook can be access (just like almost any Windows application) as an ActiveX component. And because windows does not have any security, it is free to do what ever you want.

To understand the workings of this procedure, it is important to realize that the registry entries under the Windows Address Book for the current user at HKEY_CURRENT_USER\Software\Microsoft\WAB\ are used for keeping track of who has been send an email already, and who not. Even if a person occurs in more than one address book, it is probably good to only send the email once, in order not to raise too much suspicion. In the same manner it is prevented that an address list is processed more than once (is this possible?).

Outlook provides a handle to all the address lists and the names in those list by calling the method GetNameSpace. The code below, traverses all the address lists. The current address list is stored in the variable a. Now check if the name of the current address list is already stored in the registry. At the end of this loop the number of addresses in the address list is stored in the registry. There is a little bug in this part of the code. If the name of the current address list is not found in the registry, the variable regv is assigned the value 1. It should have got the value 0. The value of regv is compared with the number of addresses in the address list, in such away that address list with just a single address are skipped. The code below is only executed once for each address list with more than one address in it. The code below is executed for each entry in the address list. The email address of the entry is stored in malead. The use of x in the code is completely redundant. At the start of the loop it always contains the same value as ctrentries, which should have been used instead. Again, to prevent an email to be sent only once to each email address, the registry is searched. The result of this search is stored in regad. At the end of the current loop the value 1 is stored under the email address in the registry. It seems that the assignment of an empty string to regad is a completely useless statement. If regad contains the empty string then an email is being sent. Below is all the code that is needed to send an email using outlook. A new item is created, with as recipients the email address stored in malead. Also the subject and body are specified, and the virus file is attached as an attachment. The last line, is the single command to send the created email. This code, the heart of the reproduction, is totally straight forward and simple, thus showing how simple it is to create a virus. The next statement stores the email address in the registry with the value 1, in order to rememeber that an email was send. Then before the end of the inner loop the counter x is incremented. At the end of the loop the name of the address list is stored in the registry. The funny thing is that it is also the last statement in the else-branch of the if-statement, which checks if the address list has been processed already. First of all, if both branches of an if-statement contain the same statement, then the statement should be placed outside the the if-statement. But secondly, it is a useless statement as the value was already stored in the registry (except for if it was a address list with a single email address), so what is the use of storing the value again? Some statements to release the object. Not really needed, as VBScript already does this for you. To follow the execution trail, continue reading the description of the procedure listadriv.

The subroutine html

This procedure contains the most clever part of the whole virus. It is part of the reproduction through mIRC (a commonly used chat program) which uses the feature that you can send an HTML file to other people on chat channel. For it to work, a HTML file need to be generated, which can generate the virus script file as part of its execution. Now there is always the problem that if you want to print some text from a programming language, that not all characters a printed verbatim. VBScript encloses strings with the double-quote character ("). If you want to enclose a double-quote character in a string, you have to repeat it. To make a string consisting of one double-quote character, you have to write: """". One way to solve this problem is to use some encoding for the special characters. (A related topic is Quines: programs which when executed output their own source.) But here we have this problem twice. We have a program P1 which when executed generates a program P2, and we have a program P2 which when executed generates a program P1. The program P1 is this VBScript, and program P2 is the HTML, which contains the VBScript. The VBScript inside the generated HTML file uses the following encoding scheme: The code below, which is used to generate the HTML file uses the following encoding scheme: Ofcourse, the subroutine starts with the usual "resume on error" statement, and the necessary declarations. What follows contains the first part of the to be generated HTML file with the encoded special characters. The workings of the generated HTML file, are described in the next section. What follows contains the last part of the to be generated HTML file with the encoded special characters. The third to fifth line contain the decoding statements that the VBScript inside the HTML file uses to decode the encoded special characters. Now decode the encoded special characters for both parts, using the chr function to represent the special characters. Open this script file, and read them line-by-line into the variable lines. The first line assign the global variable fso again. Now encode the special charachters according to the encoding used inside the VBScript of the generated HTML file. Also add the string "&vbcrlf& _" to all, but the last line. Now create the HTML file from all of the above parts. To get an idea what will be the contents of LOVE-LETTER-FOR-YOU.HTM, looks the next section. To follow the execution trail, continue reading the description of the procedure spreadtoemail.

Generated HTML file

Here the working of the HTML file LOVE-LETTER-FOR-YOU.HTM, which is generated by the subroutine html, are described. Below the HTML is given, interspersed with my comments. Again, I have taken the liberty to reformat the contents slightly, in order to improve readability.

The HTML file start with the header containing the same comments also found at the top of the virus file. The description "simple but i think this is good..." is really funny in the light of the damage that the virus has caused.

Next is the body of the HTML-document. If starts with defining two tricky event handlers. It will reopen the document as soon as the mouse leaves the window, or when a key is pressed. Now comes the contents of the document, which encourages the user to enable ActiveX control which will give access to the whole system of the user, which is needed for the virus to do it's work. Now starts a small Java Script program, which will maximize the browser window. Yes, do not give the user a means to escape, drive him crazy, and she will give in. Now starts the core of the script, which will reproduce the original virus file on the hard drive of the user's computer. The fragment below starts with the usual statements. The last statement, will be followed by the whole encoded text of the original virus file. The following statement gets the File System Object which will give access to the hard drive. The next statement retrieves the system directory. The following three statement decode the encoded representation of the original virus file into the variable code4. The following statement create a file with the name MSkernel32.vbs in the system directory (which fails if ActiveX is not enabled). Now the code checks if the file was really created. If not add a statement to the text of the document, which should urge the user to switch on ActiveX. Now modify the registry to point to the created virus file, such that it will be executed everytime during startup of the computer from now on.

My life as a hacker | Software Engineering