Expert: Link in ILOVEYOU virus refers to Philippine university

May 6, 2000
Web posted at: 2:56 p.m. EDT (1856 GMT)

In this story: Computer catastrophe avoided Some suspect man in Manila RELATED STORIES, SITES

By D. Ian Hopper, CNN Interactive Technology Editor

(CNN)-- According to a noted computer security investigator, another piece of malicious software linked to the "ILOVEYOU" computer virus, written by the same author, pinpoints a college in the Philippines.

When the ILOVEYOU virus runs, it attempts to change the user's start page to one of four pages, all located on one Internet provider in the Philippines -- Sky Internet. That page downloads and runs an executable file called WIN-BUGSFIX.exe.

It is that executable file program that scans a user's hard drive for username and password combinations, e-mailing them off to another e-mail address in the Philippines -- mailme@super.net.ph.

Sky Internet was tipped off to its involvement in the virus early in its infection by a European Internet provider, and only a few users downloaded the more dangerous part of the virus, according to Toby Ayre, a spokesman for Sky Internet.

"By 4:30 we had removed the (executable file). It only attacked a couple hundred people in Europe," Ayre said.

If that portion of the attack had reached more people, the results could have been catastrophic for computer users around the globe.

"I'm just happy the second part didn't hit the world," Ayre said. "It would have been extremely pathetic with 40 million people trying to change their passwords. Every password from every infected computer would have to be changed."

Computer security investigator Richard M. Smith, the man who identified the author of the infamous "Melissa" virus last year, says he has gone through the secondary payload's code and has found the same sort of signatures in the original ILOVEYOU virus text.

Both are signed by "spyder," Smith says, and make reference to a company in the Philippines called GrammerSoft Group. But the executable file also refers to "AMA Computer College," which is based in the Philippines.

Amable Mendoza Aguiluz Computer College has seven campuses in the Philippines, according to the college's Web site, and over 10,000 students. It offers four-year degrees in Computer Science and Computer Engineering.

The file specifically identifies the Quezon City campus of AMA Computer College. Sky Internet is also based in Quezon City.

Ayre told CNN.com that the person behind the virus had been trying to break directly into Sky Internet for some time, but his phone number was blocked from the provider's servers on April 1.

Then the author did an end run, breaking into the servers of Impact, another Manila Internet provider, in order to hop over to Sky Internet's network and place the file.

Ayre said that Impact is cooperating with authorities, as is Sky Internet. The Philippine National Bureau of Investigation, Interpol, the FBI and the National Infrastructure Protection Center are working on the case.

Ayre says authorities told him a warrant will be served soon in the international investigation to find the creator of the virus.

Besides mailme@super.net.ph," the same person has a second e-mail address at the same Internet provider -- spyder@super.net.ph," according to Manuel Bong, a spokesman for Access Net, which owns Super.Net. Both viruses contain the text,"by: spyder."

Bong told CNN.com that his company believes the author is a 23-year-old man from the Pandacan neighborhood of Manila.

Although law enforcement sources in Washington also said investigators believe the virus may have originated with a young man in Manila, they caution that address codes can be faked.

Manila police said they are checking on a possible suspect but have made no arrests.

Authorities may be zeroing in on ILOVEYOU suspect
May 5, 2000
Copycat viruses following 'ILOVEYOU' computer bug are no joke
May 4, 2000
Government computers: The ultimate hackers' proving ground
March 23, 2000
'Melting Worm' slithers into the wild
March 17, 2000
Viruses boom on the Net
January 18, 2000
Protect against Trojan Horses
January 17, 2000
Viruses anew pop up post-Y2K
January 5, 2000

Federal Bureau of Investigation
F-Secure Web - Main index
   •F-Secure Virus Info Center
Symantec Worldwide Homepage
   •Symantec AntiVirus Research Center
Norman

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.