Originally created 05/11/00

Investigators search for computer virus suspects



MANILA, Philippines -- A student at a Philippine computer college wrote a password-stealing program very similar to the "ILOVEYOU" computer virus that has struck computer systems worldwide, a school official said today.

Officials at AMA Computer College examined programs written for thesis projects after investigators linked the school to the virus, said Manuel Abad, the college's executive vice president. However, he refused to identify the author of the program, which he said was "very close" to the virus.

FBI agents, meanwhile, provided a list of 10 pseudonyms that may be connected to the virus, and Philippine investigators were trying to decode them, an official said today.

Several FBI agents are in the Philippines cooperating in the search for the virus programmer. Federico Opinion, director of the National Bureau of Investigation, said his office has no computers of its own and has relied on information supplied by the FBI and by Philippine Internet service providers.

A bank employee who was arrested Monday and labeled a primary suspect was released today until evidence, including computer diskettes seized at his apartment, can be fully investigated, officials said. His girlfriend, who shares the apartment, was still being sought for questioning.

The bank employee, Reonel Ramones, 28, denied any involvement with the virus.

"What hurts is that I did not do it and yet they are pinning me down," he told The Associated Press. "The problem here is I am not even fond of the Internet."

Ramones, an accounting graduate, said he works in the user support department of Equitable Bank, a Philippine bank. His work entails receiving calls from users about computer problems that he refers to technicians, he said.

The virus has caused a flood of e-mails with the subject line "ILOVEYOU" to course through computer systems in more than 20 countries since it appeared last week. When opened, the virus can destroy graphics and other saved files.

Several variations appeared soon after -- one masquerading as an e-mail joke, another as a receipt for a Mother's Day gift.

Investigators said they traced the virus to the address of Ramones' apartment in Pandacan, a lower middle class Manila neighborhood. In a raid on the apartment Monday, they seized computer diskettes, wires, telephones and other computer accessories, but no computer or modem, they said.

Opinion said he could not comment further on the FBI's list of names -- obtained from Sky Internet, a Philippine Internet service provider -- until they are decoded and checked with AMA Computer College.

All the names could be pseudonyms of a single person or several people, he said.

Information culled from various Philippine Internet service providers has indicated that the virus programmer is a 23-year-old living in Pandacan who has claimed to be male.

A U.S. computer security company, ICSA.net, also said earlier that comparisons of the "ILOVEYOU" virus with a password-stealing program indicated the author was an AMA student.

Abad said the program the school found had been rejected as a thesis project "because we saw something there that will download passwords of other users. This is not allowed to be developed. We don't encourage that."

It was written mostly in Visual Basic, the same programming language used for the "ILOVEYOU" virus, he said.

"It was very simple. Once you triggered it, it would look for passwords and pass them back," Abad said. "I think we have a strong lead here."

The school has 10,000 computer students.

Relatives of Ramones said he is innocent and they believe the culprit could have been the brother or sister of his girlfriend, both of whom also live in the Pandacan apartment.

The sister graduated last year from AMA in computer engineering and the brother is a senior. Both are missing.

Philippine investigators have faced difficulties because the country has few laws tailored to computer crimes and few high-tech investigative resources.

Investigators plan to use a law against improper use of commerce "access devices" such as credit cards, account numbers and passwords to charge the virus creators, he said. The law carries a maximum penalty of twice the amount obtained by fraud in addition to up to 20 years in prison.

Presidential Executive Secretary Ronaldo Zamora said the Philippines had not yet decided whether it will allow governments of other countries affected by the virus to seek damages from any suspects.

He urged the Philippine Congress to quickly pass legislation covering high-tech crimes.

"It is clear that the virus caused much damage. We were not affected that much, but the Philippines was used as the point of origin," Zamora said.