I Love You Sister

What the I Love You Virus Actually Was

The "I Love You" worm hit in May 2000 and it was devastatingly simple. It spread through Outlook as an email with the subject line "I Love You" and an attached file called "LOVE-LETTER-FOR-YOU.TXT.VBS". People would open it, thinking it was just a text file, and the VBS script would execute immediately on their machine. The virus copied itself to the system directory, overwrote files with extensions like .jpg, .mp3, .doc, and .xls with copies of itself, and emailed copies to everyone in your Outlook address book. It infected an estimated 50 million computers worldwide within ten days before vendors could release proper patches. It caused something like $10 billion in damages globally. If you are dealing with this on an older Windows system — and I mean really old, since it targeted Windows 98, ME, and XP mostly — here is what you need to do. Modern systems like Windows 10 and 11 are largely immune because the vulnerability required users to open attached VBS scripts through Outlook Express, which modern Outlook handles differently. Step one: boot into Safe Mode. Restart the machine and hold F8 before Windows loads. Select Safe Mode. This stops most of the self-replication behavior so you are not fighting an uphill battle while the script keeps reactivating itself every time you open Outlook.

Step two: delete the script file. It hides in several locations by default. Go to C:\Windows\System32\ and look for "LOVE-LETTER-FOR-YOU.TXT.VBS" or similar filenames. Also check C:\Windows\ and C:\Windows\System\. Delete whatever you find. The script often renamed itself to look like a harmless text file while keeping the VBS extension hidden because Windows default settings hide known file extensions. Step three: clean the registry. Open regedit and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. You will likely see an entry pointing to the virus script. Delete it. Check the same path under HKEY_LOCAL_MACHINE as well. This prevents the virus from auto-starting on reboot. Step four: clear temporary files and browser cache. Run disk cleanup and delete everything in your Temp folders. The worm sometimes dropped additional copies into temporary directories that were easy to miss if you were only checking the system root.

I ran into this problem a few years ago on an old lab machine that still had Windows XP hanging around. The email had somehow made its way onto that machine through an archived contact list. What tripped me up was that after deleting the main script, the virus reappeared on reboot. I spent about twenty minutes scratching my head before I realized the registry key at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce was still pointing to a copy in the Temporary Internet Files folder. I missed that location the first time because it is not obvious unless you know to look there. Once I cleared both the registry key and the temp copy, it stayed gone.

What You Should Know Before Trying Any Manual Removal

The main thing people get wrong is assuming that deleting the visible script file is enough. It is not. The virus is designed to be persistent by design. It drops copies in at least three different system directories and registers itself in multiple startup locations. If you only remove one or two, the remaining copies will reinfect the system within minutes of rebooting. A full manual cleanup requires checking every plausible location, not just the obvious ones. Another common mistake is forgetting to disable the email auto-forwarding behavior that comes with the worm. Even after the script is deleted, if the machine sends copies of itself to anyone in your address book during the time the virus was active, you become part of the spread. I have seen people clean their own machine but then spend the next hour apologizing to colleagues because the worm was still emailing out from a background process they did not know was running. There is also a nuance that most guides skip. The I Love You worm uses VBScript, which means it depends entirely on the system having VBScript-enabled in Internet Explorer settings. On machines where VBScript had been disabled through group policy or security tools before the virus arrived, the worm simply does not execute. This is why some computers in heavily locked-down corporate environments escaped unscathed while brand-new machines sitting next to them got wiped clean. If you are on an older system and VBScript is still enabled by default, you are sitting on a potential vulnerability even if you have never received that specific email.

The realistic workaround for most people today is not manual removal at all. Antivirus software from Symantec, McAfee, Kaspersky, and Windows Defender all have signatures for this worm going back over twenty years. Running a full scan in normal mode will catch and remove the script and all its copies in a fraction of the time it takes to dig through the registry by hand. The manual method only makes sense if you are working offline, on a machine where antivirus is not available or has been compromised, or if you are studying malware behavior for forensic purposes. I would also note that if you are actually encountering this on a production system, the damage is rarely limited to just the virus. The worm overwrites media and document files with copies of itself, so any .jpg, .mp3, .doc, or .xls files on the infected drive are gone. There is no way to recover overwritten data from the disk unless you have backups. I had a case once where someone focused entirely on cleaning the virus and only later realized their family photo archive had been trashed. The technical cleanup took about fifteen minutes. The data recovery effort, which turned out to be impossible, took the better part of a day of frustration. There are also edge cases with networked environments. If this worm hit a shared drive or a mapped network location, it can spread beyond the original machine. In one scenario I dealt with, cleaning the host computer was not sufficient because the script had already propagated to a file server through a mapped drive letter. Removing the virus from the endpoint only stopped the bleeding at the source. The server had to be cleaned separately, and then everyone who had accessed that server during the infection window needed their machines scanned as well. It is easy to overlook the network component if you are only looking at the local system.

If you want to download a dedicated cleanup tool rather than doing this by hand, most major antivirus vendors offer free scanner downloads. Windows Defender offline scan is probably the simplest option if you are on Windows 10 or 11, even though the risk of encountering the actual worm on those systems is extremely low. For legacy systems, Kaspersky's free removal tools are reliable. Bitdefender and ESET both had standalone scanners that handled this particular worm well in my experience. None of them require payment or installation — just run the portable scanner and let it do the work. The bottom line is that the I Love You virus was never especially sophisticated. It was a social engineering attack wrapped around a basic VBS script. The people who built it were mostly students in the Philippines, and one of them, Armel Marcelino, was arrested and became something of a cautionary figure in early internet law. But sophistication was not the point. The vulnerability was human curiosity, and that has not changed much in the twenty-five years since it first appeared. Reading older emails from archived contact lists or opening attachments from unknown senders is still the primary infection vector today, even if the specific "I Love You Sister" variant is largely a relic of the early 2000s.