Related topics

‘Love Bug’ Virus Suspect Arrested

May 8, 2000

MANILA, Philippines (AP) _ Philippine investigators today arrested a man suspected of being linked to the ``ILOVEYOU″ computer virus after raiding his apartment and finding computer equipment.

The man’s live-in girlfriend, who was not at home at the time, was also considered a suspect, said Federico Opinion, chief of the National Bureau of Investigation. The girlfriend promised to appear later at the investigation headquarters, where she was expected to be arrested.

The man’s relatives, however, said they believe the real culprit may have been the girlfriend’s 23-year-old sister, who also lives in the apartment. The sister recently graduated in computer engineering from the Philippines’ AMA Computer College _ a school linked by one U.S. computer security firm to the virus.

The virus has caused a flood of e-mails with the subject line ``ILOVEYOU″ to course through computer systems in more than 20 countries, overwhelming computer networks. Several variations appeared soon after. When opened, the virus can destroy graphics and other saved files.

The suspect, Reomel Ramones, ``opted to remain silent,″ an investigator said. But local radio reports quoted Ramones as denying any involvement with the virus.

Ramones and the other residents of the apartment were gone at the time of the raid. Ramones was arrested when he returned later.

Investigators, armed with a search warrant, cordoned off the street around the apartment in Manila’s Pandacan district. They seized computer magazines, accessories, diskettes and other materials from the apartment, Opinion said.

Two FBI agents accompanied the investigators, he said. Several FBI agents are in the Philippines cooperating in the search for the virus programmer.

Investigators were led to the apartment because of ``confidential information given to us by confidential informants,″ Opinion said, without elaborating.

Although Ramones works in the computer department of Equitable Bank, he is an accounting graduate and his specialty is computer hardware, not software, his relatives said.

They said the computer in the apartment was almost always locked in the room of the sister of Ramones’ girlfriend.

For several days, information culled from various Philippine Internet service providers has indicated that the virus programmer was a 23-year-old living in Pandacan who claimed to be male. Ramones is said to be in his mid-30s.

A U.S. computer security company, ICSA.net, said comparisons of the ``ILOVEYOU″ virus with a password-stealing program written earlier indicate the author was a student at AMA Computer College.

Michelle Navarro, the school’s dean of students, said it has more than 10,000 computer programming students nationwide, 3,000 of them at its main campus in Quezon City in metropolitan Manila.

She said she was unaware of any student having created a computer virus or being involved in any computer-related offense.

In a statement, the school said it will ``never condone any act which will result in the improper use of information technology to the detriment of society.″ It said school authorities have been directed to cooperate with investigators in ``pinning down the culprit as well as his or her allies, if any.″

On Saturday, FBI agents obtained logs of messages sent by people victimized by the virus to its creator.

Jose Carlotta, chief operating officer at Access Net, one of several Philippine Internet service providers believed to have been used by the programmer, said he gave six to seven pages of e-mail logs to FBI agents.

Carlotta said most of the 5,000 messages contained in two e-mail addresses in the Access Net server were from irate victims, but some included praise for the programmer’s skill.

The messages passed through a U.S. e-mail address, which then forwarded them to the two Access Net e-mail accounts used by the virus creator, Carlotta said.

Meanwhile, tens of thousands of Japanese returned to work today from a weeklong holiday to find the ``Love Bug″ virus that has swept around the world since last week waiting in their computers.

Government officials and antivirus software companies issued emergency warnings to computer users not to open suspicious-looking files in their e-mails.

As of early today, the number of infected files reached 73,000, according to Akitsu Hirasawa, a spokeswoman for Trend Micro Inc., a leading Tokyo-based antivirus software firm.

When the rest of the world was panicking over the virus, Japan was virtually unaffected because most companies and government offices were closed for the ``golden week″ holidays that began April 29.

``We are concerned that the infection might spread further, since today is the first working day after the holiday week,″ Hirasawa said. ``Our customer support center is already flooded with calls regarding the virus.″


On the Net:

National Infrastructure Protection Center at http://www.nipc.gov/

CERT Coordination Center at http://www.cert.org

Anti-virus companies, including Trend Micro at http://www.trendmicro.com; Symantec at http://www.symantec.com; Network Associates at http://www.nai.com

Update hourly