By Nancy Parello, Associated Press, 04/02/99
TRENTON, N.J. -- One week after the cunning e-mail virus named ''Melissa'' began swamping computers across the country, authorities said Friday they had arrested a man who created the bug in his apartment and named it for a topless dancer.
David L. Smith, 30, was arrested Thursday night at his brother's house in Eatontown.
The charges against Smith include interruption of public communications, conspiracy and theft of computer service. He faces a maximum of 40 years in prison and a $480,000 fine.
Smith was released on $100,000 bail. State Attorney General Peter Verniero said a grand jury would begin hearing the case.
No one answered the door at Smith's second-floor apartment in the central New Jersey town of Aberdeen on Friday. The blinds were drawn on his windows and a sliding glass door to a small balcony.
Melissa appeared on March 26 and spread rapidly around the world on Monday like a malicious chain letter. It came disguised as an ''important message'' from a friend or colleague and caused affected computers to fire off 50 infected messages, slowing e-mail systems to a crawl.
Government agencies, companies and thousands of other institutions have been affected.
Smith has worked as a network programmer for a company that did subcontracting for AT&T Corp., Verniero said. He declined to provide any more information about Smith, his employment history or a possible motive.
''No one can get in the mind of the individual,'' Verniero said.
Smith allegedly created the malicious virus in his apartment and spread the bug using a stolen America Online account, said Christopher Bubb, head of a state computer analysis unit.
AOL contacted state authorities after an in-house investigation turned up evidence that pointed to New Jersey, Bubb said. Using the information provided by AOL, investigators in the state's computer unit, with the aid of federal experts, were able to trace the virus to Smith's phone number. The investigation took about three days.
The virus was named for a topless dancer in Florida, where Smith once lived, authorities said. Verniero spokeswoman Rita Malley would not say how that was known.
Investigators wouldn't explain how they tracked Melissa to Smith's phone, saying the investigation is ongoing. But Don Willmott, executive editor of PC Magazine Online, said e-mail always can be tracked.
''No matter how creative you think you are, you always leave a digital trail,'' he said.
State authorities searched Smith's home. Verniero wouldn't say what authorities found in Smith's apartment, but police hauled out several cardboard boxes and briefcases.
Verniero said Smith cooperated when he was arrested at the home of his brother, whose name was not disclosed.
An executive of a small software company in Cambridge, Mass., told The Associated Press earlier this week that he had found clues linking the virus to a writer who uses the computer handle ''VicodinES.''
Malley said Smith was ''definitely not'' the person who used that handle, but investigators believe he took one virus from ''VicodinES'' and combined it with another virus to create Melissa.
The attachment the Melissa virus uses is a Microsoft Word document that lists Internet pornography sites. Once the user opens the attachment, the virus digs into the user's address book and sends infected documents to the first 50 addresses.
A variation that appeared Tuesday -- carrying the name Melissa.A -- leaves the subject line blank, a change that can foil electronic filters meant to detect and delete the original virus-bearing message, said Dan Schrader, director of product marketing for Trend Micro Inc., an antivirus company in Cupertino, Calif.
Another variant, ''Papa,'' attaches a Microsoft Excel spreadsheet document which, when opened, sends out 60 e-mails. However, Papa has bugs that sometimes prevent it from working.
