Second suspect arrested in Internet worm case

IASI, Romania -- Police in Romania on Wednesday arrested a 24-year-old man in connection with a computer-crippling Internet worm, according to a computer security company that aided police.

The company, Bucharest-based BitDefender, identified the man as Dan Dumitru Ciobanu, a 24-year-old graduate of the Technical University of Iasi, in northeastern Romania.

Police detained Ciobanu in connection with a modified and milder version of the Blaster worm, said Patrick Vicol, a virus analyst at BitDefender. Dubbed MsBlast.F, it was unleashed on computers of the Technical University, Vicol said.

Last week, Minneapolis high school senior Jeffrey Parson, 18, was charged with letting loose a different variation of the Blaster worm.

Authorities said Parson admitted during an interview with FBI and Secret Service agents that he tinkered with the original "Blaster" infection that made computers attack the Microsoft Web site last month. Prosecutors said Parson's worm affected at least 7,000 computers.

In Romania, Vicol said BitDefender had responded to a police request to track down the author of MsBlast.F.

Company analysts traced Ciobanu through some Romanian-language text inside the virus that eventually led them to a Web page containing Ciobanu's home address and telephone number, Vicol said.

"We tracked him using the bulletin boards. He actually gave his name -- not a very smart thing to do," Vicol said in a telephone interview.

The Romanian-language message in the virus "says something not very polite about a teacher" at Ciobanu's former university, Vicol said.

Vicol stressed that both Ciobanu and Parson are suspected of merely modifying the text of the original Blaster, not of authoring the virus that snarled computer networks worldwide beginning Aug. 11 by exploiting a flaw in Microsoft Corp.'s Windows operating systems.

Unlike the original Blaster that experts say infected at least half a million computers, Vicol said he doubted the "F" version had spread beyond Romania.

Police seized computers from Ciobanu's home and workplace -- at a photo developing lab -- that BitDefender will analyze for evidence of the worm, Vicol said.

Ciobanu could face up to 15 years in prison under a new law in Romania, according to BitDefender's Web site.

Parson faces one count of intentionally causing damage to a protected computer. Conviction could bring a maximum 10 years in prison and a $250,000 fine.

------

On the Net:

http://www.bitdefender.com

Technical University of Iasi: http://www.tuiasi.ro