A NetWare Nightmare - How a Windows Based Virus Can Effect Novell NetWare - GIAC Incident Handling Certification - Part 1 - The Exploit

Sep 17, 2026

A NetWare Nightmare explains how the ILOVEYOU email worm spread across networks by exploiting weaknesses in Microsoft Outlook and Internet Explorer. It describes the initial love-letter lure, execution through Windows scripting and VBScript attachments, rapid Internet-wide propagation via address books, and follow-on variants that reused the same malicious payload. The paper details impacted Windows platforms, how Windows Scripting Host is enabled by default, and the organizational consequences of widespread address-book sharing.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages62

Reading Time22 min

AccessFree to download

A NetWare Nightmare

Background

Part 1-The Exploit

Name and variants

Operating System (Windows scripting host)

Global Information Assurance Certification Paper Copyright SANS InstituteAuthor Retains Full Rights This paper is taken from the GIAC directory of certified professionals.Reposting is not permited without express writen permission. Interested in learning more? Check out the list of upcoming events offering "Hacker Tools,Techniques,and Incident Handling (Security 504)" at http://www.giac.org/registration/gcih # A NetWare Nightmare: How a Windows Based Virus CanEffect Novell NetWare GIAC Incident Handling Certification James Manion ## Background: While working at a local college an attack was invoked upon the college's network.Theattack infected mail servers including clients using POP3 mail programs.Web servers andvarious subnets throughout the campus were brought to their knees.The sad part is that thiseasily preventable attack was kicked off by an unknowing user and was later restarted onpurpose by another user.The attack did not target the college specifically.The purpose of theworm was to invoke havoc on as many unsuspecting users as possible across the entire Internet. The attack came in the form of an innocuous email claiming to be a love letter with thesubject ILOVEYOU.Since the worm used the address book of the user,the recipient wouldprobably recognize the sender and assume the email and attachment to be legitimate.The bodyof the email instructed the reader to open the attachment to view the love letter.The body read:“kindly check the attached LOVELETTER coming from me”.When the attachment was opened,the worm was activated and the email was resent to all users within the recipient's Outlookaddress book. The worm spread throughout the Internet in just a few hours.Since most places shareaddress books within the organization and there are usually accounts like “ALL'or “ALL USERS”it was very easy to infect an entire organization,as wellas infect everyone who was listed in eachindividual's personal address book.Soon organizations all over the Internet were infected.TheUnited States Congress,the U.S.Air Force,the British Parliament and many other govemment,education and business entities were infected.Just as network administrators were getting ahandle on this worm,new worms that were just cheap imitations of the ILOVEYOU worm startedto show up.A Mother's Day variant soon was spreading across the Internet and reinfecting thesame users.Anti-virus vendors were quick to create a fix and most had a fix in place and newvirus definitions on their websites within a day.However,this led to a new variant,which claimedto be an email from the Anti-virus vendors with the fix attached to the email.Unfortunately,thiswas just a hacked version of the original ILOVEYOU worm with basically the same maliciouspayload. All of these variations took advantage of exploits within Microsof's Outlook and InternetExplorer.The worm used capabilities within windows scripting which is installed when InternetExplorer is installed.This type of scripting permitted Visual Basic Scripts to be sent asattachments and executed.If not configured properly,Outlook would automatically execute thescripts when the email was read.When the wom was executed,it not only emailed itself to otherusers it would also delete and modify certain multimedia files,as wellas alter the user's IntemetExplorer settings and try to send it self to chat rooms via Internet Relay Chat. The worm used a unique way of social engineering to help propagate itself and infectother users.Most users could not resist the urge to open an ILOVEYOU message from someonethey knew.And for this reason the worm continued to spread.Here are the details about theILOVEYOU worm. ## Part 1-The Exploit Name: The ILOVEYOU worm is commonly known by the following names.VBS.LoveLetter.A(Symantec naming convention),Lovebug,IwWorm.LoveLetter,VBS/LoveLetter.A,VBS/LoveLet-A ## Operating System: All Microsoft Windows platforms that have the Windows Scripting Host enginesinstalled can be

FAQs

How did the ILOVEYOU worm convince users to activate the attachment?

It arrived as an email framed like a love letter with the subject ILOVEYOU. The message instructed recipients to open an attachment to view the letter, and the attachment activated the worm.

How did the worm spread across an organization and the Internet?

After execution, it resent itself to users listed in the recipient’s Outlook address book. Because address books were commonly shared within organizations, it could infect many accounts quickly.

Which Windows capability enabled the worm’s execution and why was it widespread?

The worm relied on Windows Scripting Host and VBScript execution via Outlook and Internet Explorer. Windows Scripting Host was installed by default on many Windows platforms, making infection easier.

Sep 17, 2026

Upload by Theodora