2d arrest made in Blaster worm case

By Associated Press, 9/4/2003

Police in Romania yesterday arrested a 24-year-old former student in connection with a computer-crippling Internet worm, according to a computer security company that aided police.

Bucharest-based BitDefender identified the suspect as Dan Dumitru Ciobanu, a graduate of the Technical University of Iasi.

Police detained Ciobanu in connection with a modified and milder version of the Blaster worm, said Patrick Vicol, a virus analyst at BitDefender. Dubbed MsBlast.F, it was unleashed on computers of the Technical University, Vicol said. Last week, Minneapolis high school senior Jeffrey Parson, 18, was charged with letting loose a different variation of the Blaster worm. Authorities said Parson admitted he had tinkered with the original Blaster infection that made computers attack the Microsoft website last month. Prosecutors said Parson's worm affected at least 7,000 computers.

In Romania, Vicol said, BitDefender had responded to a police request to track down the author of MsBlast.F. Analysts traced Ciobanu through text inside the virus that eventually led them to a Web page containing Ciobanu's address and phone number. "We tracked him using the bulletin boards. He actually gave his name -- not a very smart thing to do," Vicol said.The Romanian-language message in the virus "says something not very polite about a teacher" at Ciobanu's former university, Vicol said. He stressed that Ciobanu and Parson are suspected of modifying the text of the original Blaster, not of authoring the virus, which snarled computer networks worldwide beginning Aug. 11 by exploiting a flaw in Microsoft Corp.'s Windows operating systems. Vicol said he doubted the "F" version had spread beyond Romania.Ciobanu could face up to 15 years in prison, according to BitDefender's website.