Romanian suspect appears in court in Blaster-F worm case, Sophos comments

Sophos Press Release
Dan Dumitru Ciobanu
Dan Dumitru Ciobanu is said to have admitted spreading the virus.

The case of a Romanian man charged with spreading the W32/Blaster-F worm is reported to have begun yesterday.

First charged September last year, 24 year-old Dan Dumitru Ciobanu, the alleged author of Blaster-F - a very similar version of the notorious Blaster-A worm, one of the most damaging computer viruses of 2003 - showed up in court in the Romanian city of Iasi.

Romanian authorities have commented in news reports that Ciobanu admitted to modifying the original Blaster virus by switching the names of folders and replacing the original message with some Romanian text. Translated into English, it reads:

"Don't go to the Hydrotechnics faculty!!! You are wasting your time... Birsan, your pension awaits!!! I urinate on the diploma!!!!!!"

This text and other clues in the code may have assisted the authorities in finding Ciobanu.

Ciobanu is said to have claimed that the virus spread itself because he tested it while his computer was connected to the internet.

"Virus distribution is costly, damaging and illegal, and guilty parties can face serious consequences for their actions," said Carole Theriault, security consultant at Sophos. "Romanian authorities have an opportunity in this trial to make a clear statement that cyber crime will not be tolerated."

If found guilty, Ciobanu faces between three and fifteen years in prison. The case is set to continue on April 6.

Last month, a Minnesota teenager suspected of authoring an earlier variant of the Blaster worm was accused of launching other internet attacks.

More than 100 million users in 150 countries rely on Sophos’ complete security solutions as the best protection against complex threats and data loss. Simple to deploy, manage, and use, Sophos’ award-winning encryption, endpoint security, web, email, mobile and network security solutions are backed by SophosLabs - a global network of threat intelligence centers. Sophos is headquartered in Oxford, U.K., and is publicly traded on the London Stock Exchange under the symbol “SOPH.” More information is available at