http://news.com.com/2100-1002_3-5071030.html By Reuters September 3, 2003 A Romanian antivirus company said Wednesday that it helped police identify a 24-year-old man arrested on suspicion of releasing a new version of the MSBlast Internet worm, the second arrest of a copycat-virus writer in the past week. Meanwhile, the culprit behind the original MSBlast remains at large. The original worm, which also goes by the names Blaster and Lovsan, surfaced last month, infecting hundreds of thousands of computers running Microsoft's Windows operating system. Romanian security company BitDefender said Romanian authorities arrested Dan Dumitru Ciobanu from the northern Romanian city of Iasi on suspicion of creating and distributing MSBlast.F, the latest version of the worm. According to information posted by U.S. antivirus company Symantec, MSBlast.F was released Sept. 1 and has achieved minimal distribution to date. The offshoot's main difference from the original worm is that it renames some files with Romanian words and attempts to launch a denial-of-service attack against an apparently defunct Romanian Web site. Ciobanu is a student at the Technical University of Iasi, according to the BitDefender statement, which quoted an investigator from the Iasi Center for Combat Against Organized Crime and Drug Enforcement. Mihai Radu, a spokesman for BitDefender, said Ciobanu has not yet been charged. Under recently passed cybercrime legislation, he faces a prison term of three to 15 years if convicted, Radu added. Police confiscated two of Ciobanu's computers. The machines will be analyzed in the presence of the defendant, his attorney and the local district attorney, officials said, as early as Thursday. Ciobanu was in police custody as of Wednesday night, Radu said. Last week, U.S. authorities arrested 18-year-old Jeffrey Lee Parson for allegedly creating and distributing the first variant of MSBlast. Ciobanu allegedly, like Parson, made it easy for investigators to find him. Radu said the virus code contained a reference to Ciobanu's nickname "Enbiei," a message written in Romanian that named one of Ciobanu's teachers, and a link to the university Web site. - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Thu Sep 04 2003 - 01:21:52 PDT