NBI ready to throw in towel on 'Bug'

The National Bureau of Investigation (NBI) is ready to throw in the towel because its efforts to pin down the creators of the so-called "Love Bug" computer virus are not bearing fruit.

They have been looking for a more applicable law that they could use to put the two suspects, computer students Onel de Guzman and classmate Michael Buen, behind bars.

Because of the lack of laws against computer hacking, the NBI plans on using Republic Act 6484 or the Access Devices Regulation Act which prohibits stealing of credit card numbers.

But the Department of Justice, in a legal opinion, said last week that law was inapplicable and was made to fight credit card fraud.

"We will still file under Republic Act 6484. If they think that is not enough so let them dismiss it," NBI Director Federico Opinion told The STAR.

"If it is wrong, then it's up to them (DOJ officials)."

Because of the setback, the NBI's anti-fraud and computer crimes division is temporarily stopping its investigation to decide its next move.

"Frankly we don't know what to do right now. We will be regrouping to decide whether or not to go with the case or not," a division member told The STAR.

The only option the NBI has is to file malicious mischief charges which only carry a maximum penalty of six months imprisonment.

"Assuming that he gets convicted, he will just apply for probation and he will be free again," said the division member.

Opinion said only a criminal complaint from companies overseas that suffered from the virus attack can save their efforts. Such a complaint may pave the way for an extradition of the suspects to the country where the complaint would have originated and which has laws against computer hacking.

Opinion ruled out the possibility of filing a civil suit. This is under the discretion of the complainants.

So far only Sky Internet, whose computer servers were used in launching the global virus attack, has filed a complaint but they are reportedly not keen on claiming damages.

"It is not even a complaint but just a request to investigate if we will be technical about it," said Opinion.

"Besides, you can't expect to collect from Buen or De Guzman. De Guzman himself took seven years to complete his studies because he had to stop from time to time due for lack of money."

NEW YORK -- Companies alerted by the "Love Bug" epidemic two weeks ago seem to have contained the spread of a new, more dangerous virus, experts said yesterday.

The virus, christened "NewLove," infected thousands of computers around the world over the past two days, but failed to achieve the avalanche-like spread of "Love Bug" because network administrators for many companies were able to block infected e-mails.

The damage to those affected was much greater, however, since "NewLove" erases almost all files on a computer it infects and causes it to crash. In comparison, the "Love Bug" targeted only a few files.

"Two weeks ago, we all got some love mail. Today we're getting hate mail. This is a very nasty one," said Simon Perry at software company Computer Associates International Inc. in Islandia, New York.

In Washington, Attorney General Janet Reno launched an FBI investigation into the new virus.

Gene Hodges at software company Network Associates Inc. in Santa Clara, California, said a company in Israel was the first to report the virus early Thursday. It shut down its connection to the Internet to curtail the spread, but the virus later surfaced in Europe and the United States.

US companies were quick to add protective measures, Hodges said, a marked difference from their reaction to the spread of the "Love Bug."

Hodges said network administrators calling two weeks ago went "Holy cow! I have 20,000 copies of this on my (e-mail server)! What do I do now?

"This time, they were saying 'I think I'm set, is there anything more I need to do?'"

Had awareness not been heightened by the "Love Bug," the new virus could have spread very fast and caused untold damage, Hodges said.

"In this perspective, 'Love Bug' was a very positive wakeup call," he said.

The "Love Bug" arrived in e-mails with an "ILOVEYOU" subject line that enticed millions of recipients to open the attachment that activated the virus. Once news spread of the virus, infected e-mails were easily detected and deleted.

Estimates of the damage caused range up to $10 billion, mostly in lost work time; the "NewLove" virus is expected to total much less, despite being more deviously designed.

"This new version can change the subject line and the program code every time it is retransmitted," Reno said at her weekly news conference. "This makes the virus more difficult for users and anti-virus programs to detect." -- AP

The subject line of an e-mail infected starts with "FW:" and includes the name of a file from the sender's computer. The e-mail will have an attachment with the same name, but it may also have a ".vbs." extension visible.

Clicking on the attachment will activate the virus. Like "Love Bug," it will send itself to everybody in the user's address book. It will then overwrite most files on the hard drive, rendering the computer useless until the operating system is reinstalled.

"This worm is too destructive to go very far," said Mikko Hypponen at anti-virus company F-Secure Corp. in Finland. "When people were hit by 'LoveLetter', they didn't notice it until they were contacted by people whom they had sent the virus to. With 'NewLove,' your computer crashes immediately and you lose your files. It's difficult to miss that."

As with the "Love Bug," it will only spread from recipients running Microsoft's Outlook e-mail program. However, it will destroy files when the attachment is opened in another program if the computer is running the Windows 98 or Windows 2000 operating systems, or has Microsoft Internet Explorer 5.0 installed under Windows 95.

A Microsoft executive said the company was "very disturbed and frustrated" by the use of the company's e-mail program to spread viruses.

Product group manager Tom Bailey said he believed the virus uses the Microsoft program because of its widespread use, not because the creator is targeting the company's product.

Next week, the company will release a modification to Outlook designed to "eradicate this type of virus," Bailey said.

Software maker Trend Micro Inc. has posted a virus-detecting pattern file on the Internet at this address: http//www.antivirus.com/download/pattern.asp