Philippine investigators question former students in 'Love Bug' case

[William Knowles <wk () C4I ORG>]

http://www.techserver.com/noframes/story/0,2294,500205714-500286297-501542599-0,00.html

By OLIVER TEVES, Associated Press

MANILA, Philippines (May 18, 2000 12:55 p.m. EDT
http://www.nandotimes.com) - Philippine investigators on Thursday
questioned at least seven former members of a group of students linked
to the "Love Bug" computer virus that crippled e-mail systems
worldwide.

The former students at the Philippines' AMA Computer College denied
any ties to the virus and claimed they are no longer active members of
the group, called GRAMMERSoft, investigator Nelson Bartolome said.

The seven were among about 40 people acknowledged in the computer code
of a second virus found by investigators on a diskette seized from a
Manila apartment where the "ILOVEYOU" virus is thought to have been
launched, investigators said.

Investigators attributed the second virus to Michael Buen, who
graduated on May 5 from AMA college.

Elfren Meneses, chief of the National Bureau of Investigation's
anti-fraud and computer crimes division, said the diskette also
contained a threat that appeared to have been written by Buen that
warned: "If I don't get a stable job by the end of the month, I will
release a third virus that will remove all files from the primary
disk."

The diskette was found in the apartment of Onel de Guzman, Buen's
classmate and friend at AMA college.

De Guzman, a member of GRAMMERSoft, has admitted he may have released
the virus accidentally, but refused to say whether he wrote it.

Meneses said only two of the seven had been summoned for questioning
but the others, believing they would be next in line, volunteered to
give statements.

It is still uncertain what charges, if any, will be filed against
suspects in the case since no Philippine law specifically addresses
high-tech computer crimes.

Buen earlier denied any involvement in making and spreading the
"ILOVEYOU" virus.

His lawyer, Florencio Dalupang, said Thursday that Buen also denied
any involvement in the second virus, whose potential effects have not
been disclosed by the NBI.

"We cannot be sure about these diskettes that they found. According to
Michael, anyone can just put names there," Dalupang said.

The investigation focused on GRAMMERSoft after its name appeared in
the Love Bug virus. It is a small group of AMA students said to be in
engaged in writing programs, including thesis projects sold to other
students for a fee.

De Guzman was unable to graduate on May 5, a day after the virus was
released, because school authorities rejected his thesis, saying it
was a form of computer piracy designed to steal passwords so people
could use the Internet for free, a feature similar to the "ILOVEYOU"
virus.

Meanwhile, Manuel Abad, executive vice president of AMA college, said
another group of students called Programming Pools were angered by
GRAMMERSoft's alleged links to the "ILOVEYOU" virus and volunteered to
create an antidote.

Karim Bangcola said about eight computer science students worked for a
week to make the antidote.

"We banded together and we analyzed the bug. We went through it,
dissected each code and went to a solution that would reverse the
action or effects of the bug," he said. "The problem now is there are
so many strains."


*-------------------------------------------------*
"Communications without intelligence is noise;
Intelligence without communications is irrelevant."
Gen. Alfred. M. Gray, USMC
---------------------------------------------------
C4I Secure Solutions             http://www.c4i.org
*-------------------------------------------------*

ISN is sponsored by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".