Filipino claims to be JPEG virus author

June 18, 2002 Sophos Press Release

Paul Glenerson B. Amurao, a 21 year old Filipino, has claimed in a media interview to be the author of the first virus to attempt to infect .JPG graphic files. Amurao, who says he lives in a province north of Metro Manila, Philippines, said he was the author of W32/Perrun-A in an interview he gave to INQ7.Net.

Amurao claimed that he wrote the virus using Microsoft Visual Basic 6, bought from a local retailer during a school fair at the University of the Philippines.

In the interview Amurao claimed that W32/Perrun was "like a time-triggered bomb waiting to explode."

"This is perhaps what virus researchers are afraid of. But thank god, somehow I was able to make them aware," he added.

"W32/Perrun-A is more hype than havoc. The virus is not in the wild, is not likely to be, and the JPEG infection method only works if the user is already infected by a Windows executable virus," said Graham Cluley, senior technology consultant for Sophos Anti-Virus."However, it's disturbing to see another virus being written in the Philippines, and that malware authors over there may consider it a cool thing to do."

The Philippines is no stranger to virus writing, being the birth place of the Love Bug (or VBS/LoveLet-A worm) which spread around the world in May 2000. Onel de Guzman, the suspected author of the Love Bug, was detained by the authorities but later released without charge because the Filipino authorities did not have sophisticated computer crime laws at the time of the offence. Laws designed to combat computer misuse were only introduced in June 2000 by the Philippines authorities as a result of the Love Bug incident.

Sophos has issued protection against W32/Perrun-A to customers concerned by the media reports and alerts from other anti-virus vendors.