A harsh lesson from 'Love Bug'

The Age of Innocence is over. You can't even trust a love note any more -- or read a joke that comes in your e-mail -- without worrying about trashing your computer or someone else's.

That's the hard lesson that millions of users learned when the Love Bug virus spread across the globe last week in a matter of hours, crashing e-mail systems and destroying files on countless hard drives.


It was a nasty piece of work that masqueraded as a message with the subject "ILOVEYOU" and contained an attachment, "LOVE-LETTER-FOR-YOU.TXT.vbs." Users who double-clicked on the attachment to read the message unleashed an evil genie that did the following:

If the viewer was using Microsoft's Outlook e-mail program, it mailed a copy of itself to everyone in the user's address book.


It hid itself in the Windows registry (the database that keeps track of system settings) to make sure that it wouldn't be destroyed and would start up every time the user turned on his computer. It even planted a seed that would allow itself to be automatically updated over the Web without the user's knowledge.

It destroyed or overwrote a variety of files, including the popular MP3 music files and digital images stored in files with the common JPG extension. That alone wiped out music libraries and wrecked thousands of electronic photo albums.

Even as virus hunters worked out fixes to intercept the message and repair infected systems, the Love Bug was mutating. Within a day of the original outbreak, it was appearing in the guise of messages bearing the subject "Very Funny" or "FWD: Joke." Within two days, at least eight versions were circulating.

There will undoubtedly be more variants, and more victims, for two reasons. First, no matter how many times they're warned, the gullible will still click on unknown e-mail attachments. Second, it has become too easy to make mischief.

The Love Bug was written in a Microsoft programming language called VBScript, which allows Web page developers to build interactive sites and which other programmers can use for a variety of purposes under Windows.

VBScript, in turn, is a dialect of Visual Basic, a so-called "high-level" language that's simple enough to allow clods like me to write programs that actually do something useful. A similar version of VB is included in Microsoft Office applications, such as Word and Excel.

This programmability is one of Windows' great strengths. Thousands of developers around the world have used VB and its predecessors to create software for business and personal use, either from scratch or by using bits and pieces of other programs. Though it takes knowledge and skill, VB doesn't require the kind of bit-tweaking, technical mind set that lower-level languages require.

For example, at The Sun we're installing a new publishing system that uses Visual Basic to modify Microsoft Word so that it can deal with the complexities of putting out a large daily newspaper. Without it, the developers of the system would have had to write a word processor from scratch -- a difficult undertaking.


Antitrust issues aside, I've always thought this was one of the keys to Windows' success. Microsoft founder Bill Gates was first and foremost a programmer, a hacker in the old and pure sense of the word. One of Microsoft's first successful products was a powerful version of the BASIC language. It was later packaged with the MS-DOS operating system and was responsible for the development of millions of nontechnical programmers who might not otherwise have learned the trade. Many of them started as kids. Microsoft snatched programming from the clutches of the professional priesthood and gave it to the common user.

When Apple brought out the Macintosh in 1983, it deliberately left these tools out of the operating system, which meant that only geniuses could develop software for the machine. That gave Apple more control over Macintosh software, but severely stunted the number of programs available for a technically superior machine.

That's one of the reasons the Mac never grew beyond its role as a niche product for schools and graphic artists. There weren't enough priests around to write for it.

The Love Bug is the dark side of Windows programmability. By giving ordinary users-turned-programmers access to powerful tools such as the computer's file system and e-mail programs, Microsoft opened the door to the kind of malicious virus writers who created Melissa (last year's nasty virus) and this year's Love Bug.

I'm a pretty sorry programmer, but when I looked at the Love Bug's source code (it's nothing more than a text file you can read by opening it with Windows' Notepad), even I could get a pretty good feel for what the creep was doing. With a few hours of studying help files and online sources, I could probably modify it and release it under a new guise. That's scary.

Since the first Word macro viruses appeared in the mid-1990s, critics have been knocking Microsoft for leaving these tools -- developed in a more innocent age -- available to hackers. Microsoft has plugged some of these security holes on a piecemeal basis, but it's hard for a company built and populated by true hackers to eliminate the very core of its success.


So, for the foreseeable future we'll just have to be more careful.

Rule One: Never, never, never open any e-mail attachment whose provenance you don't know, even if it appears to come from a friend or business associate. If you're in doubt, ask the person who sent it.

Be particularly careful of attachments that have the extensions .vbs or .exe. These are VBScript and standard program files, respectively. Also be suspicious of Word (.doc) and Excel (.xls) files from correspondents you haven't dealth with before. They can contain macro viruses.

Rule Two: Install an anti-virus program if you don't have one and keep it up to date once you have it. It may not help you if you're the first victim of a new virus, but it will keep you from becoming the 100,000th victim once the bug is identified. Both Symantec (Norton Antivirus, and Computer Associates (McAfee ViruScan, will do the job. Both sites offer plenty of advice and information, including instructions for getting rid of the Love Bug if you're infected. For the latest virus news, try WiredNews ( and ZDNet (