Students Named in Love Bug Probe

By DIRK BEVERIDGE
Associated Press Writer

MAY 10, 06:43 EDT


School official releases names
AP/Ed Wray [22K]

MANILA, Philippines (AP) — Two students at a Philippine computer college wrote software programs that may have been combined to make the ``ILOVEYOU'' virus that disabled e-mail systems worldwide, school officials said today.

``We are not saying they are the culprits,'' said Manuel Abad, executive vice president at the AMA Computer College in Manila. But Abad characterized the information, which has been shared with investigators, as ``potential leads for further confirmation.''

Investigators have not designated either of the students, Onel A. de Guzman and Michael Buen, as suspects. The two were members of an underground computer group called GRAMMERSoft, which provided programming to small- and medium-size businesses and also wrote and sold thesis projects to computer students, Abad said.

The whereabouts of De Guzman were unknown, but he lived in the same apartment as a bank employee who was arrested on Monday on suspicion of involvement with the virus, then later released because of a lack of evidence.


Onel de Guzman
AP/Ed Wray [12K]

Investigators have traced the ``ILOVEYOU'' virus to a telephone line in the apartment.

Relatives of the bank employee, Reonel Ramones, have said they suspect de Guzman is responsible. Justice Secretary Artemio Tuquero acknowledged today that Ramones may have been ``a fall guy'' but said it was too soon for officials to clear him.

Buen graduated Friday — one day after the virus jolted businesses and governments around the world, creating disruptions that may cost as much as $10 billion, mostly from lost productivity.

Buen was not at his home when a reporter visited today, but his mother, Emma Buen, said her son only had an old computer that he didn't use for accessing the Internet. ``I know that he has nothing to do with it,'' she said.

De Guzman's software program was able to steal passwords and was written as a thesis proposal at AMA Computer College. But the idea was rejected on Feb. 24, with a thesis reviewer at the school noting: ``This is illegal'' and ``We do not produce burglars.''

A copy of the thesis proposal was obtained by The Associated Press today.

In the proposal, de Guzman wrote that the software ``will be helpful to a lot of people, especially Internet users,'' who want to get passwords and spend more time on the Internet without paying. He added that the program would help ``steal and retrieve Internet accounts of the victim's computer.''

Onel's sister, Irene de Guzman, is Ramones' girlfriend and is being sought by investigators for questioning.

Buen's program, which was accepted as thesis material, was able to create multiple copies of computer files, Abad said.

Ramones was released Tuesday while investigators searched for evidence among 17 computer diskettes seized in a raid of his apartment on Monday.

FBI agents have made copies of the diskettes and are studying them separately in Manila, said Elfren L. Meneses Jr. of the National Bureau of Investigation.

U.S. Embassy officials were not immediately available for comment.

The love bug virus spread quickly through more than 20 countries last week, surging into e-mail addresses stored in the computers of anyone who got an infected e-mail message and opened an attachment titled ``ILOVEYOU.''

When opened, the virus can destroy graphics and other saved files and steal passwords. Several variations have cropped up, one appearing to be an e-mail joke and another purporting to be a receipt for a Mother's Day gift.

Cracking the ``Love Bug'' case has been a daunting task for the Philippine police, who lack high-tech equipment as well as cyber-savvy investigators. They have also been hindered by a shortage of local laws that can be applied to computer crimes.

Philippine investigators are trying to identify a person or people who used 10 computer pseudonyms culled from the Internet. Meneses, who heads the NBI's Anti-Fraud and Computer Crimes Division, was unable to report any progress today.

The division appears anything but high-tech. A sign outside the office is handmade and attached to the window with tape, while a copy machine sitting atop an old green filing cabinet inside displays an ``out of order'' sign.

Facts About the Computer Love Bug

By ANICK JESDANUN
AP Internet Writer
MAY 04, 22:22 EDT


A computer virus disguised as an electronic love note greeted Internet users around the world Thursday.

Here are some details:

Q. What is this virus all about?

A. The virus, technically known as a worm, is software written to spread itself automatically through e-mail or chat rooms. It began spreading through Asia and Europe while Americans were still sleeping. Circulation in the United States skyrocketed when the workday began.

Q. What does it look like?

A. The virus usually comes as e-mail from a friend or other familiar address. ``ILOVEYOU'' appears in the subject line. The note asks the recipient to ``kindly check the attached LOVELETTER coming from me.'' Clicking on the attachment, ``LOVE-LETTER-FOR-YOU.TXT.vbs,'' activates the virus.

Q. What does the virus do?

A. It can destroy or hide certain graphics, music and other files. It may also steal certain passwords and send them to an e-mail account believed based in the Philippines. As the virus replicates, it can also clog computer networks, causing delays and shutdowns.

Q. How does the virus spread?

A. If Microsoft Outlook e-mail program is used, the activated virus will automatically send copies to everyone listed in the program's address book. Users of other e-mail programs and non-Windows computers can also inadvertently spread the virus by forwarding the love note to a friend. The virus can also spread using through some chat room programs.

Q. Is this the same as last year's Melissa virus?

A. No, although it spreads in much the same way that Melissa spread. While Melissa limited copies to 50 people in the address book, the love virus can spread itself to hundreds, even thousands of other addresses. Plus, Melissa did not spread through chat rooms.

Q. How does this virus compare with other viruses?

A. Of the tens of thousands of known computer virus, security experts say this is the fastest to spread, partly because it does not limit its targets as Melissa did. Plus, Melissa first struck on a weekend, giving computer administrators time to clean out their networks before workers returned. David Perry at Trend Micro Inc., an anti-virus software maker, also notes ``brilliant social engineering'' on the part of the virus writer. ``Who doesn't want to open an e-mail that says they love you?'' he said. ``My wife sends me e-mail with `I love you' on top. I would have clicked on it.''

Q. What should computer users do?

A. Install anti-virus software and get the latest update from the manufacturer's Web site. Do not open the attachment, ``LOVE-LETTER-FOR-YOU.TXT.vbs.'' Select highest security options for browser, e-mail and chat room programs. Network administrators should also screen incoming mail to remove messages with the virus.

——

On the Net:

http://www.cert.org


CERT® Advisory CA-2000-04 Love Letter Worm

                           Original release date: May 4, 2000
                           Last revised: May 9, 2000
                           Source: CERT/CC


Last updated 2000/05/10
Archived at the Department of Computer Science web site with the kind permission of:

in support of college education.