Questions surround Romanian Blaster suspect

Conflicting reports have emerged about the fate of a Romanian man suspected of being the author of a version of the Blaster worm,...

Conflicting reports have emerged about the fate of a Romanian man suspected of being the author of a version of the Blaster worm.

Romanian police officially denied reports that they had a suspect in custody for allegedly creating the W32.Blaster-F worm, according to a report from the Associated Press.

However, the Romanian antivirus company that identified the 24-year-old suspect said he was at police headquarters in Iasi, Romania, and co-operating with police.

"They're not denying it any more," said Mihai Radu, communications manager for Softwin SRL, a computer security company based in Bucharest.

"We've been talking to the police today. They've identified the subject and are investigating him," Radu said.

Softwin, which owns the BitDefender security software brand, is helping police with their investigation into the Blaster-F variant, which contained hidden messages written in Romanian and references to a university and professor in the city of Iasi.

The company was the first to announce a breakthrough in the case, claiming authorities in Romania had arrested Dan Dumitru Ciobanu of Iasi and charged him with creating and releasing the Blaster-F worm. However, no official acknowledgement of Ciobanu's arrest followed the statements from Softwin.

Mikhaela Mixim, a spokeswoman for the prosecutor's office in Bucharest, said that she did not have any information on the case, referring requests to the chief prosecutor in Iasi.

As a result, the main source of information about the investigation continues to be Softwin.

Radu stuck by his company's public statements, saying that police in Iasi had arrested Ciobanu after tracking him down at work and seized computer equipment from his home.

The suspect was released shortly after and disappeared, only to return at police headquarters saying that he wanted to co-operate with the investigation, he said.

Ciobanu allegedly used the online name "enbiei", a phoneticised version of NBA, the National Basketball Association in the US, which was also the name of the Blaster-F virus file, Radu said.

Radu claimed the suspect is now helping police try to recover information from a computer hard drive taken from his home. The information on that drive was erased after Ciobanu read a BitDefender press release linking the Blaster-F worm to Romania.

Romanian police may be reluctant to speak about the case until they have enough evidence to convict Ciobanu, Radu said.

In the meantime, Softwin experts are helping police by analysing copies of the data taken from Ciobanu's hard drive.

Paul Roberts writes for IDG News Service

Read more on IT risk management