Love Bug author tracked

An NBI official with the disks being investigated

The Love Bug virus that crippled e-mail systems worldwide was apparently written by a friend of the student who accidentally released it.

Investigators in the Philippines, where the virus is thought to have originated, said a floppy disk seized from the apartment of Onel de Guzman contains a program that resembles the virus.

"[It] was supposedly authored by a certain Michael Buen, an AMA (Computer College) student, with acknowledgement to Onel de Guzman and a certain group called GRAMMERSoft," Elfren Meneses said on Tuesday.

Mr Buen has flatly denied any involvement in the virus

Mr Meneses - who heads the anti-fraud and computer crimes division of the National Bureau of Investigation (NBI) - said the strain of the virus was found among the deleted files on the disk.

GRAMMERSoft - an underground group of computer students to which Mr de Guzman belonged - was being investigated, he added.

Mr Meneses said the program on the disk was written in the same programming language - Visual Basic - used to create the virus. However, officials had not confirmed that the two programs were identical.

A file on the disk named more than 40 people, including 30 AMA students. He said the NBI would interview some of the people named in the list - which included President Joseph Estrada.

He added it was still too early to name a main suspect in the case.

Threat found

Officials said the disk also contained a warning, believed to be written by Mr Buen, which said: "If I don't get a stable job by the end of the month, I will release a third virus."

On Sunday, Mr Buen flatly denied any involvement in the creation or release of the "ILOVEYOU" virus which left a trail of damage worldwide.

The bug caused up to $10bn damage

"In an effort to restore some semblance of normality to my life and that of my family, I should like to categorically state for the record that I have no involvement or participation whatsoever," he said.

Mr Buen graduated from the college on 5 May - a day after the virus was released, unlike Mr de Guzman, who did not graduate because his thesis on a program to steal passwords was rejected by the college.

Mr de Guzman has declined to say whether he was the author of the virus.

Officials from AMA college have said the virus could have been a result of combining programs written by the two students.

Blacklisted

Investigators used call line identification to find out which phone had been used to set up a dial-up connection to the internet and upload the virus. The trace revealed that a phone in the apartment of Mr de Guzman was used.

Sky Internet said it had placed this telephone number on a "blacklist" in April - which blocked calls from the line - after attempts to break into the company's computer network.

The virus was uploaded onto Sky Internet from a dial-up user on another Philippine-based service provider - ImpactNet.

The passwords for ImpactNet and Sky Internet accounts had been stolen, Sky Internet said.