Talk:ILOVEYOU

External links modified

Hello fellow Wikipedians,

I have just modified one external link on ILOVEYOU. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:

• Added archive https://web.archive.org/web/20111027131918/http://tech.ca.msn.com/photogallery.aspx?cp-documentid=27611570&page=1 to http://tech.ca.msn.com/photogallery.aspx?cp-documentid=27611570&page=1

When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.

This message was posted before February 2018. After February 2018, "External links modified" talk page sections are no longer generated or monitored by InternetArchiveBot. No special action is required regarding these talk page notices, other than regular verification using the archive tool instructions below. Editors have permission to delete these "External links modified" talk page sections if they want to de-clutter talk pages, but see the RfC before doing mass systematic removals. This message is updated dynamically through the template {{source check}} (last update: 5 June 2024).

• If you have discovered URLs which were erroneously considered dead by the bot, you can report them with this tool.
• If you found an error with any archives or the URLs themselves, you can fix them with this tool.

Cheers.—InternetArchiveBot (Report bug) 04:23, 10 September 2017 (UTC)

File extensions and Outlook

The current wording is that "The attachment exploited a feature of Microsoft Outlook where only one file extension would be displayed."

• Filenames in Windows only ever have one real extension.
• The text is referring to a feature of Windows, not Outlook. (The "Hide extensions for known file types" option in Explorer.)
• I could not find any primary source that Outlook hid extensions for known file types. I did a Google Image Search and could not find a single screenshot of Outlook showing "LOVE-LETTER-FOR-YOU.TXT" without the ".vbs". Even expanding the search to any image of Outlook's attachment handling, could not find a single one of Outlook hiding a known extension. Close calls:
  • One showing Outlook for Macintosh.
  • Screenshots (including the one in this article), where at first, for a long name, the entire filename is truncated (without any regard for extensions, fake or otherwise). After beginning to interact with it (even just hover or select), all screenshots indicate that the full file name and extension are displayed.
• (I know that screenshots aren't a source, but no technical article corroborates the current claim, and most of this is basic Windows knowledge, so it should at least be removed if there's doubt.)

"As the file name was parsed from left to right, which would be stopped after the first period, to victims the attachment would appear to be an inconspicuous .txt file incapable of holding malware."

• The description of parsing from left to right and stopping at the first period is also incorrect even in Explorer. For example, if you have "Example.txt.jpg.vbs" and you have "Hide extensions for known file types" on, then it will be displayed as "Example.txt.jpg".

"De Guzman also claimed that a bug in Windows 95, where code in email attachments was automatically run upon being clicked, contributed to the worm's success."

• This is a recollection 20 years later of someone who would have incentive to downplay responsibility. No mechanism is proposed and no technical report confirms it.

"the Philippine Congress enacted Republic Act No. 8792, otherwise known as the E-Commerce Law, in July 2000"

• The law document describes itself as enacted in 14 June 2000.
• Even if you mean the day it took effect, it's 19 June 2000 (Search for "On June 19, 2000")

HamburgerRadio (talk) 18:37, 4 October 2025 (UTC)

Ok, I tried to clean up the factually of the file name claims. Still could use some work. Also noticed that cyberhoot was not a quality source and everything was covered in the .edu so just removed it. --HamburgerRadio (talk) 19:45, 6 October 2025 (UTC)

I think everything's done here - HamburgerRadio, any thoughts? Pahunkat (talk) 07:44, 29 April 2026 (UTC)

• "over fifty million infections had been reported" -- Computer Weekly and Wired report 45 million. It's one of those things that can't be truly known, so it would be better to give it with appropriate confidence.
• "considered to be one of the first examples of malware using social engineering" -- is either wrong, or so vague to be meaningless. 1999 already saw outbreaks of Melissa, ExploreZip and many variants and copycats. Going further back, the 1987 Christmas Tree EXEC is described as similar to Loveletter.
• "his belief that internet access was a human right", "de Guzman removed this geographic restriction out of curiosity", "De Guzman did not expect this worldwide spread." -- it's treating later author statements with a lot of confidence.
• computerhope.com reference is an anonymous article on an unofficial site, and used as a reference for information that could easily be found elsewhere.

--HamburgerRadio (talk) 18:02, 30 April 2026 (UTC)

Appreciate the pointers, I changed the following:

• Fifty mil -> tens of millions
• Changed to just utilizing social engineering.
• Removed the latter two as UNDUE, kept the first since it's on a section about his motivation and so his statements naturally have more weight there.
• Replaced.

Thanks, Pahunkat (talk) 07:53, 3 May 2026 (UTC)

Suggestion for early antivirus response coverage

Hello,

During the initial ILOVEYOU outbreak in May 2000, an antivirus tool I developed was distributed to UK government departments before commercial antivirus solutions were available, helping contain the spread in critical systems.

A detailed, verifiable account of this response is published in BCS ITNOW (Oxford Academic): Full text: https://www.bcs.org/articles-opinion-and-research/25-years-ago-the-iloveyou-worm Citation & DOI: https://academic.oup.com/itnow/article-abstract/67/3/36/8238834

This information could be considered for the section covering early containment or mitigation efforts.

-Cary Byman FBCS InsideOutGlobal (talk) 01:59, 7 October 2025 (UTC)

Hi all, just checking if anyone has had a chance to review this source yet. It’s a published account from BCS ITNOW (Oxford Academic) covering the early antivirus response.InsideOutGlobal (talk) 06:23, 21 October 2025 (UTC)

من پیشنهادی برای خلاصه نویسی دارم

ه 2A02:4540:68:92F:1:0:D7DE:A041 (talk) 10:57, 16 October 2025 (UTC)

This is the English language Wikipedia. Please write in English, not Persian. --Hammersoft (talk) 16:54, 16 October 2025 (UTC)

We do not regret to inform you that this is the Wikipedia for ENGLISH speakers. Please go to the citation link in my comment. Theonethatknowsyouripaddress (talk) 14:31, 2 April 2026 (UTC)

GA review

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

This review is transcluded from Talk:ILOVEYOU/GA1. The edit link for this section can be used to add comments to the review.

Nominator: Pahunkat (talk · contribs) 07:48, 29 April 2026 (UTC)

Reviewer: AdaCiccone (talk · contribs) 07:17, 8 May 2026 (UTC)

Hi Pahunkat, I'll be reviewing this nomination. I'll post the reviews soon. But looking at a glance, I see that the Architecture section is a bit too technical. More details will come later. AdaCiccone (talk) 07:17, 8 May 2026 (UTC)

Thanks AdaCiccone, sounds good - assuming this isn't a quickfail I'll address issues as they come in. I don't anticipate anything pressing that would prevent me from fixing within the 7 days. Pahunkat (talk) 07:44, 8 May 2026 (UTC)

I don't think this is a QF material but we'll see as the review progresses. Anyway, I see that the most recent edit was two days ago when you added citations. Just wanna say (I'm sure you already know/are aware of this), it'll be helpful to the whole process if you do not edit or add anything major during the whole GA review process, unless of course if the additions themselves are prompted by the review process. AdaCiccone (talk) 07:50, 8 May 2026 (UTC)

Reviewer comments

About the prose

• I noticed some minor issues regarding the prose and I immediately fixed them. This is so that I can raise the more important issues.
• As I said before, the Architecture section is the most technical one. I understand that for an article about a malware, technical terms are unavoidable but some sentences stack too many operations without enough plain-language framing. Some examples:
  • To prevent multiple emails being sent to one person from each successive run of the worm, a registry key is generated for each address book entry once an email has been sent.
    • Changed to "The worm records which address book entries it has sent emails to, so multiple emails are not sent to the same person each time the worm is run." "The worm records which address book entries it has sent emails to, so only one email is sent to each contact even if the worm is run multiple times." Pahunkat (talk) 09:22, 10 May 2026 (UTC) edited Pahunkat (talk) 09:24, 16 May 2026 (UTC)
  • Upon opening the file, the worm copies itself into relevant directories and modifies the Windows registry so it will be run upon reboot of the computer.
    • Changed to "Upon opening the file, the worm creates copies of itself that are run upon reboot of the computer" Pahunkat (talk) 09:22, 10 May 2026 (UTC)
  • De Guzman wrote ILOVEYOU in VBScript, and the Windows Script Host is utilized to run the code
    • Changed to "De Guzman wrote ILOVEYOU in the programming language VBScript. The Windows Script Host is used by Windows to run its code." Pahunkat (talk) 09:22, 10 May 2026 (UTC)

Check other technical prose that may be difficult to read. Tell me if you need assistance, I'll try my best to help.

• I changed the examples listed above, and a few more, in this edit. Let me know if there are items here which still need work. Pahunkat (talk) 09:22, 10 May 2026 (UTC)

• Some sentences are wordy, not smooth, and may sound stiff or awkward to some. Try simplifying it:
  • The worm's use of its previous victim's address book further incentivized recipients to comply...
    • Split into two, now reads "By using each victim’s address book, emails sent by the worm appeared to come from close contacts. This further encouraged recipients to run the worm." Pahunkat (talk) 10:00, 10 May 2026 (UTC)
  • The use of VBScript in ILOVEYOU's coding allowed for easy modification to change the worm's behaviour.
    • Changed to "Since ILOVEYOU was coded in VBScript, it was relatively easy to modify the worm’s code and change its behaviour." Pahunkat (talk) 10:00, 10 May 2026 (UTC)
  • Originally designing ILOVEYOU to only work in Manila, de Guzman removed this geographic restriction, which allowed the worm to spread worldwide.
    • Split into two. Changed to "De Guzman designed ILOVEYOU to only work in Manila. He later removed this restriction, which allowed for the worldwide spread of the worm." Pahunkat (talk) 10:00, 10 May 2026 (UTC)
  • Variants exhibited a variety of behaviours that differed from the original worm...
    • Changed to "Variants of ILOVEYOU differed from the original worm in many aspects, …" Pahunkat (talk) 10:00, 10 May 2026 (UTC)
  • The use of VBScript in ILOVEYOU's coding allowed for easy modification to change the worm's behaviour.
    • Duplicate of above. Pahunkat (talk) 10:00, 10 May 2026 (UTC)
  • Whole networks were compromised through a singular attachment access by any one user.
    • Changed to "One user opening an attachment was enough to compromise entire networks." Pahunkat (talk) 10:00, 10 May 2026 (UTC)
  • Further investigations by ISPs linked the malware to a phone line associated with an apartment belonging to de Guzman's sister.
    • Changed to "ISPs also linked ILOVEYOU to a phone line registered to de Guzman’s sister’s apartment." Pahunkat (talk) 10:00, 10 May 2026 (UTC)
  • Authorities initially presented him as the main suspect for the creation of the worm and sought to find De Guzman's sister, however released him a day later because of insufficient evidence.
    • Found this a bit harder to reword, decided to split with a semicolon. Changed to "Authorities initially presented him and de Guzman’s sister as their main suspects; however, they later released him due to insufficient evidence." Let me know if you have better ideas. Pahunkat (talk) 10:00, 10 May 2026 (UTC)
• The Cultural impact section may need a better prose because as it stands now, it reads like a list. Each item there is presented one after another with limited connective framing. But also be mindful that connective phrases (if you want to add them) need to be backed up with reliable sources.

  Had a go at it, how does this look now? Pahunkat (talk) 08:05, 15 May 2026 (UTC)

• The layout structure is good. The article starts from the origin, to technical operation, to real-world spread, to legal/investigative aftermath, and then legacy. That order is understandable and reader-friendly.
  • However, 'architecture' doesn't seem to relate to its content, because it mostly talks about what happens once the worm opens. Nothing about architecture.
    • Changed to "Technical details" Pahunkat (talk) 09:25, 10 May 2026 (UTC)
  • Also, '2019 interview of de Guzman' is a bit narrow when the content isn't strictly about the interview itself. Something like '(his) Later whereabouts and admission' reflects the content better.
    • Changed to "Later whereabouts and admission of de Guzman" Pahunkat (talk) 09:25, 10 May 2026 (UTC)

Sources check

There are 50 refs in total, and I'm gonna check per batch of ten each. As of the latest edit, I've checked 30 of them. Here's the ones that need attention.

• Ref #6 (NYTimes): This one says he was a college dropout and that charges were later dismissed, but it does not say he dropped out in order to begin developing the worm. So this one should be reworded to better reflect the source.

  Yoinked the bit about later developing the worm, since authorship is covered in the section's first sentence anyway. Pahunkat (talk) 10:05, 11 May 2026 (UTC)

• Ref #10 (VICE): This one supports the attachment looking like a text file named “LOVE-LETTER-FOR-YOU” but I did not find the .TXT.vbs in it. Other sources, however, do mention the TXT.vbs like Margaret Kane's ZDNET article.

  Now references the ZDNET. Pahunkat (talk) 10:05, 11 May 2026 (UTC)

• Ref #3 (TIME): This one supports the claim of de Guzman telling reporters the internet was educational and should be free but it doesn't use the 'human right' framing. But the Wired source does.

  Removed TIME for the human right bit, left WIRED. Pahunkat (talk) 10:19, 10 May 2026 (UTC)

• Ref #5 (NYTimes): There's one tiny difference here. The article uses the word closed-minded while the source uses close-minded. Not a huge problem, but it's better to be close to what the source says

   Done Pahunkat (talk) 10:04, 10 May 2026 (UTC)

• Ref #12 (The Register): This one supports the bigger idea that ILOVEYOU helped demonstrate the power of social engineering, but has resulted in the use is stronger than the source. The source touches more on legacy and influence, not direct causation.

  Changed to "The worm's subsequent success demonstrated the capability of social engineering, which continues to be used in many modern-day malware attacks" Pahunkat (talk) 10:05, 11 May 2026 (UTC)

• Ref #13 (Smithsonian): This one supports the idea that the attachment appeared to promise romantic content and played on the desire to be loved. But nowhere does it support the wording under the pretext they had a lover who was attempting to contact them. I think the current wording is more specific and more dramatic than what the source says.

  Now reads "by playing on their romantic desires" Pahunkat (talk) 07:30, 14 May 2026 (UTC)

• Ref #20 (CNN): This one doesn't support the claim of a notable variant of ILOVEYOU, NewLove. It explicitly says "Despite its name, ‘NewLove’ is not very similar to ‘ILOVEYOU’... Despite that, they are two different viruses."

  Downgraded it to just a computer worm. CNN supports similarities in replication to ILOVEYOU, so I now elude to that. Now reads "Computer worm NewLove, which spread in a similar fashion to ILOVEYOU, ..." Pahunkat (talk) 10:36, 11 May 2026 (UTC)

• Ref #21 (CNET): I'm not sure if 'sneaks around traditional virus scanners' is the same as 'evaded antivirus software.'

  Added [www.nytimes.com/2000/05/20/business/experts-warn-of-new-virus-hitting-pc-s.html this NYtimes ref], which is a bit more specific. Per that source, "The program constantly changes its length by altering the number of lines of code it is made up of, an effort to escape discovery by antivirus software that uses file size as a detection signature," which I reckon counts as evasion. Pahunkat (talk) 10:36, 11 May 2026 (UTC)

• Ref #22 (MessageLabs): This one doesn't say anything about Manila’s Pandacan district.

  Removed. Now used for just the date. Pahunkat (talk) 07:14, 15 May 2026 (UTC)

• Ref #23 (ZDNET): This one doesn't support the CIA operations being significantly obstructed. 'Affected' reflects the source better.

   Done Pahunkat (talk) 10:36, 11 May 2026 (UTC)

• Ref #24: This, along with #22, support Philippines, May 4, and Pandacan-linked suspect, but not necessarily worm originated in Pandacan. The way it's written now makes it seem that worm had its technical origin in that district, when actually the source only says that the suspect is from Pandacan. This one also quotes a CIA spokesman, who said the worm's impact on CIA computers was 'negligible', which doesn't align with one sentence in the article claiming that CIA operations being significantly obstructed.

  Pancadan bit removed per #22. CIA bit changed to just affected per #23, also see this testimony which has the CIA as one of the agencies affected. Pahunkat (talk) 07:14, 15 May 2026 (UTC)

• Ref #27 (BCS): This one doesn't support the claim of Email systems had to be shut down due to the volume of incoming mail sent by the worm. It only says 'email servers' were 'overwhelmed.' Ref #23 and #26 are better.

  Replaced with #23. Pahunkat (talk) 07:30, 14 May 2026 (UTC)

• Ref #29 (DTIC): The US$79.2k figure is presented in the source as an 'estimated cost'. It doesn't say anything about 'recovery cost.'

  Fixed. Pahunkat (talk) 07:30, 14 May 2026 (UTC)

• Ref #31 (CBS News): This one says ISPs traced the virus to a telephone line in de Guzman’s apartment, not the sister's. Further, ref #38 say investigators traced the virus to an apartment where de Guzman was living with his sister and her boyfriend. Ref #32 says investigators traced it to an email address registered to an apartment in Manila, whose occupant’s brother was Onel de Guzman. The current wording in the article should therefore be changed to avoid implying that the sister owns the apartment.

  I've gone with "registered to an apartment associated with de Guzman." I think there's general confusion between news sources regarding who owned said apartment, see this source which I've now put in the article, that puts his sister as the owner. Nevertheless, this new wording should cover both bases. Pahunkat (talk) 07:14, 15 May 2026 (UTC)

• Ref #32 and #33 (BBC and Computer Weekly): These two support the story that de Guzman’s mother hid his computer equipment, and that police later found diskettes connected to classmates or other names, including Michael Buen. But the Computer Weekly source says the diskettes contained de Guzman’s classmates’ names, not malware. Also, #32 and #33 don't support the Quinta Market location.

  Removed references to malware. Added WIRED for the Quinta market ref - it's referred to as the Quiapo market here, which appears to be an alternate name for the place. I've also updated the article to use Quiapo Market over Quinta Market. Pahunkat (talk) 07:46, 14 May 2026 (UTC)

• Ref #40 (Tech Radar): This one supports the lower-end US$10 billion damage estimate, but it is a retrospective tech-news source. Therefore it'd better to pair it with stronger sources, especially because contemporaneous sources note that overall losses were difficult to estimate precisely.

• I decided to change this to "approximately 10 billion", and three sources back it up. No idea what happened to the sourcing here, I'm certain I had other sources for 15 but I think I've put in the wrong ones and can't find the old ones again. EBSCO gives a pretty broad range anyway (~3-15 billion), and if I were to add in a range again this is probably what I'd use. Pahunkat (talk) 09:24, 16 May 2026 (UTC)

• Ref #44 (Wiwo): This one supports ILOVEYOU inspired the Pet Shop Boys song 'E-mail', but it does not support the album title (Release), the chart position or the release year.

  Everything referenced in the rewrite. Pahunkat (talk) 08:05, 15 May 2026 (UTC)

• Ref #46 & #47 (NECSUS & ArtAsiaPacific): These support the Kiat Kiat projects but there's a mismatch about the year. Both sources point to 2019, not 2009. Ref #46 says the exhibition was distributed on 30 January 2019, and ref #47 describes How to Prevent Hair Loss as a 2019 email-based project.

  Fixed in rewrite. Pahunkat (talk) 08:05, 15 May 2026 (UTC)

• Ref #48 (Spot.ph): This source supports the film title, year/context, and cast. But it does not mention ILOVEYOU and oddly refers to a 2002 computer virus, even though ILOVEYOU was in 2000.

  Added another ref in the rewrite which references ILOVEYOU specifically. Unfortunately, looks like the ABS-CBN news article the Spot.ph article was based on is lost to time. Pahunkat (talk) 08:05, 15 May 2026 (UTC)

• Ref #50 (Cyberart): This one was published in July 2024 and is written prospectively. It says the museum was preparing to open in November 2024 and that one exhibit would be an ILOVEYOU sculpture made from donated computer mice. However, it does not by itself support the museum actually included the sculpture after opening.

  Trimmed out in the rewrite as one of the weaker examples. Pahunkat (talk) 08:05, 15 May 2026 (UTC)

Assessment summary

GA review – see WP:WIAGA for criteria

1. Is it well written?

   A. The prose is clear and concise, and the spelling and grammar are correct.

   B. It complies with the manual of style guidelines for lead sections, layout, words to watch, fiction, and list incorporation:

2. Is it verifiable with no original research, as shown by a source spot-check?

   A. It contains a list of all references (sources of information), presented in accordance with the layout style guideline.

   Easy pass. The article has the ref list, and isn't one that is under-sourced.

   B. Reliable sources are cited inline. All content that could reasonably be challenged, except for plot summaries and that which summarizes cited content elsewhere in the article, must be cited no later than the end of the paragraph (or line if the content is not in prose):

   C. It contains no original research.

   D. It contains no copyright violations nor plagiarism:

   No issue here.

3. Is it broad in its coverage?

   A. It addresses the main aspects of the topic:

   Pass. The article covers the main aspects. Identity, origin, author, technical operation, social-engineering method, spread, impact, investigation, legal aftermath, later interview, and cultural legacy. The lead itself too cover these points. The missing puzzles from what I've read are why Windows/Outlook/Windows Script Host created the conditions for the worm’s spread and defensive response/mitigation. Both are for further improving reader's understanding but they are minor additions and I wouldn't fail this criterion for this alone.

   B. It stays focused on the topic without going into unnecessary detail (see summary style):

   Generally focused. But I think the cultural impact section needs a trimming. It reads like a a small catalogue. Try trimming one or two weaker examples or adding a short framing sentence so that it reads more like a legacy and less a miscellany.

4. Is it neutral?

   It represents viewpoints fairly and without editorial bias, giving due weight to each:

   The article isn't promotional, sensational, or unfairly sympathetic. Strong claims about the worm's destructiveness are sourced, and the article presents the creator, damage, investigation, and legal aftermath in a generally balanced way.

5. Is it stable?

   It does not change significantly from day to day because of an ongoing edit war or content dispute:

   Checked the Talk page and the article's history page. There's nothing to indicate a significant, day-to-day change or an ongoing edit war and content dispute.

6. Is it illustrated, if possible, by images?

   A. Images are tagged with their copyright status, and valid non-free use rationales are provided for non-free content:

   The lone image at the infobox is hosted on Commons and marked public domain as consisting only of common-property information without original authorship. No licensing issue here.

   B. Images are relevant to the topic, and have suitable captions:

   Infobox image is relevant and has the appropriate caption.

7. Overall:

   Pass or Fail:

   I'll put this On hold in order for the nominator to address the issues I've raised above. AdaCiccone (talk) 05:52, 10 May 2026 (UTC)

   After reviewing the changes from the nominator and re-reading the article, I've decided that this article has passed all the six GA criteria. I'll be updating the relevant pages to reflect this. AdaCiccone (talk) 03:01, 21 May 2026 (UTC)

Hi AdaCiccone, thanks for the review. I've had a shot at dealing with the issues you raised - please see my comments above, and let me know if any further improvements are needed. Pahunkat (talk) 09:27, 16 May 2026 (UTC)

Hi, I'm gonna be looking at the changes in a day or two. AdaCiccone (talk) 01:48, 18 May 2026 (UTC)

The changes look good. Here's the remaining issues left to be fixed:

Lead and body are different on the damage estimate. Either the body should say estimates in the 2020s place it between US$10 billion and US$15 billion or the lead should be reduced to approximately US$10 billion in damage.

The was also based off the worm claim is supported by an article about Toni Fowler and Hajie Alejandro, not a source about Subject: I Love You. I suggest using this one instead: https://grahamcluley.com/i-love-you-virus-inspired-movie-trailer-and-world-premiere/ AdaCiccone (talk) 10:49, 19 May 2026 (UTC)

AdaCiccone -  Done both. Pahunkat (talk) 18:35, 19 May 2026 (UTC)

Okay, thank you. Let me re-read the article before deciding. AdaCiccone (talk) 02:50, 21 May 2026 (UTC)