April 2, 1999
Suspect in Melissa Virus Is Arrested in New Jersey
By THE ASSOCIATED PRESS
TRENTON, N.J. -- A central New Jersey man has been arrested by
federal and state officials and charged with originating the e-mail
virus known as Melissa, the state attorney general's office announced
on Friday.
The man, David L. Smith, 30, of Aberdeen, was arrested Thursday night
at his brother's house in nearby Eatontown, said Rita Malley, a
spokeswoman for Attorney General Peter Verniero.
Smith originated the virus, which caused worldwide e-mail disruption
this week, from his apartment in Aberdeen, Malley said. She said the
virus is named after a topless dancer from Florida, where Smith used
to live.
He is charged with interfering with the public communication, which
carries a sentence of five to 10 years in prison and up to a $150,000
fine, Verniero said. Smith was released on $100,000 bail.
Smith was captured with the help of America Online technicians, and a
computer task force composed of federal and state agents, Malley said.
Verniero said authorities found Smith through "good old-fashioned
gumshoe police work," canvassing neighborhoods and identifying other
family members who led them to Smith's brother's house. Verniero
would not release the brother's name.
Smith cooperated with authorities when they arrived to arrest him,
Verniero said.
Verniero said David Smith was a network programmer for a company that
did subcontracting for AT&T Corp. The company's name was not
immediately available.
No one answered the door at Smith's second-floor apartment in the Ken
Gardens complex in Aberdeen on Friday. The blinds were drawn to his
windows and on a sliding glass door to a small balcony.
The complex's assistant manager declined comment on Smith. Several
neighbors at the complex said they didn't know Smith.
An executive of a small software company in Cambridge, Mass., told
The Associated Press this week that he had found clues linking the
virus to a writer who uses the computer handle "VicodinES."
Malley said Smith was "definitely not" the person who used that
handle, but also said investigators believe he took two viruses, one
of which came from "VicodineES," and combined them with another virus
to create Melissa.
Richard Smith, president of Phar Lap Software, a firm that makes
operating systems and software tools, said he thought the virus
writer distributed it using an account stolen from America Online 15
months ago.
Melissa appeared last Friday and spread rapidly around the world on
Monday like a malicious chain letter, causing affected computers to
fire off dozens of infected messages to friends and colleagues and
swamping e-mail systems.
It disrupted the operations of thousands of companies and government
agencies whose employees were temporarily unable to communicate by
e-mail.
The virus arrives to its victims disguised as an e-mail from a
friend, with a note in the subject line saying that an important
document is attached.
The attachment is a Microsoft Word document that lists Internet
pornography sites. Once the user opens the attachment, the virus digs
into the user's address book and sends infected documents to the
first 50 addresses.
A variation that appeared Tuesday -- carrying the name Melissa.A --
leaves the subject line blank, a change that can foil electronic
filters meant to detect and delete the original virus-bearing
message, according to Dan Schrader, director of product marketing for
Trend Micro Inc., an antivirus company in Cupertino, Calif.
Another variant, "Papa," attaches a Microsoft Excel spreadsheet
document which, when opened, sends out 60 e-mails. However, Papa has
bugs that sometimes prevents it from working.
The danger is that virus writers will find the variants on the
Internet, correct the bugs and distribute them further.
------------------------------------------------------------------------