Love Bug suspect is detained

Police in the Philippines have reportedly detained a man suspected of creating the Love Bug computer virus, which caused international mayhem late last week.

According to various reports today, officers from the National Bureau of Investigation (NBI) have taken a 27-year-old man into custody. The man was led in handcuffs by NBI officers from the back of an apartment in the Pandacan district of Manila earlier today.

Investigators seized a telephone, wiring equipment and computer magazines from the man's house, but no computer.

Agents said they were waiting to question a woman who also lives at the apartment.

The FBI and Interpol helped track the virus to the Philippines through a tangled electronic web of evidence that has thrown up several contradictory leads.

Police originally thought the main suspect was male but later said they were hunting a female computer school student from a middle-class family.

The Love Bug worm, which creates a flood of emails with the subject line ILOVEYOU, is estimated to have caused hundreds of millions of damage in lost productivity and damage to computer systems worldwide.

The worm in all its variants so far only affects systems running Microsoft Windows with Windows Scripting Host enabled. Computers using Apple's operating system or Linux remain unaffected.

Once opened as a Visual Basic Script (VBS) attachment by an Outlook mail client, the virus is executed on the local machine. It affects image and music files, such as JPEGs and MP3s, and also tries to download malicious software from around the internet. At the same time, the virus attempts to mail itself to all addresses in the Outlook address book.

Variations of the virus continued to appear over the weekend, one of which masqueraded as a receipt for a Mother's Day gift. Even more worrying, this variant posed as a warning message from the technical support team at antivirus vendor Symantec.

Security clearing house Cert said it had received more than 400 direct reports involving some 420,000 internet hosts.

A Cert spokesman said: "Reports of the worm have levelled off, but we continue to receive reports of variants. At least 10 variants have been identified, and we expect more variants to appear as the week goes on."

"We continue to advise users to keep their antivirus software up to date. Additionally, users should exercise extreme caution in opening attachments and should not open executable attachments including files with a .VBS extension."