The Johns Hopkins Gazette: May 15, 2000
May 15, 2000
VOL. 29, NO. 36


Response Team Battles With the 'Love Bug'

Immediate action of new computer security team limits spread of virus

By Greg Rienzi
The Gazette

Johns Hopkins Gazette Online Edition

Hopkins was not immune to the "I Love You" virus that assailed computers worldwide on May 4, but an institution-wide effort managed to keep the bug in check, according to Michael McCarty, chief networking officer for Hopkins Information Technology Services.

The virus, which struck early in the morning, arrived embedded in an attachment to an e-mail with the subject line "I Love You." Within hours, 15 of the 116 managed computer servers on the East Baltimore campus became infected, as did a number of work stations across the university. UNIX servers and Macintosh systems did not seem to be affected, however.

Additional computers and servers were not contaminated, McCarty said, due to the prompt efforts of the Computer Security Incident Response Team, a nascent group made up of personnel from the university and the Johns Hopkins Medical Institutions.

As soon as the response team learned of the problem, it issued a "first alert" message to warn of the virus and tell people what to do if they encountered it. McCarty said a swift response is the best defense for such a crisis.

"The major reason this was not more of a significant problem for us is that we were able to get the word out so quickly," McCarty said.

The response team, whose structure is still being formalized, was established to deal with such computer-related issues as virus infiltrations, hackings or any major security incident.

McCarty said HITS and Johns Hopkins Medicine Center for Information Services personnel were able to isolate contaminated computers and prevent other "love bug" e-mails from entering the various campuses. For example, they quickly developed software that was able to search individual work stations for the virus as the user logged in and send a message to the user if he or she had an infected system.

When opened, the love bug virus is executed instantly and destroys graphics and other saved files on the infected computer system. The virus then replicates itself by using the computer's e-mail address book and forwarding itself to every person listed. McCarty said the virus, designed to target Microsoft e-mail and operating systems, predominantly infects only files associated with system extensions, including those with the suffix .jpeg or .vbe.

University e-mail servers were down for a period of roughly four hours on May 4 while technicians assessed the extent of the problem. Twenty-nine variants of the virus have been identified to date, and McCarty said efforts are still under way to contain their spread.

Many of the files lost on the affected servers and individual work stations were able to be recovered because of system back-up procedures.

For more information on the "I Love You" virus, go to or contact HITS support services at 410-516-HELP or 410-955-HELP.