Virus probe points to AMA grad

A diskette seized from the apartment of an AMA Computer College student who says he may have accidentally released the "Love Bug" computer virus contained a similar virus that was apparently written by schoolmate Michael Buen, the National Bureau of Investigation (NBI) said yesterday.

Buen, who graduated from AMA early this month, claimed Sunday he was not involved in the creation or release of the "ILOVEYOU" program that crippled e-mail systems worldwide last May 4.

But the diskette also revealed a warning that investigators believe was written by Buen, which said in part: "If I don't get a stable job by the end of the month, I will release a third virus."

The evidence, which investigators referred to as "Diskette 17," was found to contain the "win-bugspecs.exe" file, the same file recovered by local Internet service providers in hacked accounts.

The new virus, which was recovered from a deleted file on the diskette, was purportedly written by Buen, investigators said.

In its code, it acknowledged Onel de Guzman, the student who admitted he might have released the "ILOVEYOU" virus, according to Elfren Meneses Jr., chief of the NBI's anti-fraud and computer crimes division.

De Guzman has declined to say whether he wrote the virus.

The virus on the diskette also acknowledged GRAMMERSoft, a shadowy underground group of computer students being sought in the probe, Meneses said.

The NBI official, however, refused to explicitly say if Buen was the author, saying "we cannot make that conclusion at this point."

Buen was not at home when a reporter phoned seeking comment yesterday, according to his mother, Emma, and the young man's lawyer did not immediately return phone calls.

The diskette was one of 17 seized in a raid on the Pandacan, Manila, apartment where De Guzman lives with his sister and her boyfriend, who became a focus of the probe after authorities traced the outbreak of the virus to the apartment's phone line. The other 16 diskettes contained no incriminating evidence, Meneses said.

He said it is still too early to name a main suspect in the case or say whether criminal charges will be filed.

NBI officials revealed few details about the virus they had discovered or any new leads they might be pursuing as they scramble to learn the origins of the program.

Both the "Love Bug" and the virus on the diskette were written in the Visual Basic programming language, said Nelson Bartolome, the No. 2 official at the NBI's computer crimes division.

In another deleted file, the diskette also contained the names of more than 40 people, including some 30 students from AMA, Meneses said. The NBI will start identifying and interviewing many of those people, he said.

Buen graduated from the college on May 5, the day after the "ILOVEYOU" virus was released, but De Guzman did not graduate because the faculty rejected a password-stealing program he had proposed as a thesis project. School officials said the "ILOVEYOU" virus could have been made by combining that program with a separate thesis project written by Buen.

Not everybody whose name appears on the diskette will be questioned, however.

Some prominent Filipinos, including President Estrada, are included in the list, with Buen apparently joking that the President would be unlikely to provide him with a good reference.