FBI intensifies Melissa manhunt

Two Web sites with connections to Melissa -- SourceOfKaos.com and Codebreakers.org -- have been shut down, allegedly at the behest of the FBI, according to the sites' Webmasters and sources at the hosting Internet service providers. A third virus site -- coderz.net -- also was down Wednesday, apparently having decided to drop out of sight before the FBI came calling.

The FBI would not comment on the shutdowns.

SourceOfKaos.com system administrator Roger Sibert, who spoke to the FBI after the Bureau seized his Web server, said the agent's questions centred mainly on VicodinES. "They asked me if I know VicodinES, and if I had any way of contacting him," he said. SPo0Ky, the Webmaster of Codebreakers.org said in an e-mail interview: "A friend who works for GlobalConnection.net (that's the ISP which was hosting our site) just told me that the FBI visited them and that he had to delete the site."

Both Codebreakers.org and SourceOfKaos.com have been connected to the Melissa macro virus via an electronic fingerprint derived from a serial number found in documents created with Microsoft Word and other Office applications. Two viruses -- Shiver and PSD2000, created by virus writers with the handles ALT-F11 and VicodinES -- contained the same electronic fingerprint as the Melissa virus. ALT-F11 was a member of the Codebreakers virus exchange, or VX, while VicodinES had a Web site hosted on the SourceOfKaos.

The FBI seized the SourceOfKaos Web server on Tuesday afternoon. The server -- housed with Access Orlando, an Orlando, Florida-based ISP -- was taken into custody by local field agents, pending a complete analysis of its contents. Until late Monday, a VicodinES home page could be accessed from the SourceOfKaos domain. According to Dan Merillat, an Access Orlando administrator, an agent from the FBI's New York office contacted the ISP and asked that the SourceOfKaos server be removed from the Internet and preserved as evidence until a search warrant was obtained.

As further documentation, Merillat said, the FBI sent a fax to Access Orlando directing it to "take all steps necessary to preserve all records and other evidence in the possession of www.sourceofkaos.com." Following the seizure, SourceOfKaos's Sibert contacted Access Orlando, then the FBI's New York office. Sibert said the FBI agent he spoke to "asked me if I was willing to volunteer to let them come in and mirror the server tonight." Although he agreed, Sibert said the agents ultimately decided not to examine the server until a search warrant could be obtained.

Sibert has previously said he had no means of contacting VicodinES. He said his last contact was on Jan. 11, when he received an e-mail from the virus writer. A copy of the message, forwarded by Sibert, suggests that VicodinES was leaving his chosen vocation. In the message, VicodinES wrote: "Hey just wanted to thank you for the use of your webspace. I have decided to quit my hobby. If you could take my dir [sic] down [/vic] and kill this pop3 it would be greatly appreciated."

The message, signed "Vic," appears to have been routed from an ISP on the East Coast of the United States. Sibert offered that information to the FBI agent, but the agent said the agent was way ahead of him. "They (the FBI) already knew that this guy was using that ISP," he said.

Codebreakers.org's SPo0Ky claimed the site was targeted by the FBI because the writer of the Syndicate variant of the Melissa virus thanked Codebreakers.org in comments found within the Syndicate macro code. "I don't know and understand what gave them the right to shut the site down," SPo0Ky said. "We did absolutely nothing illegal by just providing (virus) information."

Dennis Halsey, vice president and CEO of Global Connection Internet Inc., denied that the company had been contacted by the FBI. The ISP took down the site, because "we had two e-mails sent to us that complained that (codebreakers.org) was spreading viruses," he said. One e-mail came from a "West Coast company," while the other came from a source that Halsey would not identify. Halsey did admit that the Webmaster -- a student who "is a young fella, at least 16-years-old" -- was a friend of his partner, James Hall, the president and senior hardware specialist at Global Connection. "They had a special arrangement," he said. "But I swear we didn't think -- and still don't -- that anything illegal was going on."

On coderz.net, a message employing the highly liberal grammatical rules favoured by Net jockeys said it was "temporarily closed due to recent development." It went on to say that "there are no viruses here, there is no source code here, there is not any reason for you, mr. fbi to be lookin here,,,, go away law-man." It then added "ohh,,, btw, coderz had nuffin at all to do with melissa" and linked visitors to a "someone who did" -- MSN.

Take me to the Melissa Virus special.