The deputy head of the UK's computer crime unit has warned companies not to become complacent about antivirus protection, as news broke that the unit has arrested two men suspected of writing an Internet worm.

Detective superintendent Mick Deats of the National Hi-Tech Crime Unit (NHTCU) said that though the number of virus reports fell in 2002, it was important for companies to remain vigilant and protect their systems against future attacks. "It is not a time to become complacent," said Deats. "New technology will continue to be an area that virus writers will attack. All new technology does is give them a new challenge." He added that an increase in script viruses meant that the average home user could now write viruses without needing specialist programming skills.

The unit's warning came as it announced it has made two arrests in its efforts against computer-related crime. Earlier this month, a 19-year-old and a 21-year-old were interviewed by officers on suspicion of computer crime offences. The two men are alleged to be members of an international hacking group responsible for creating the TK worm that attacks computers via Internet chat channels.

The worm is reported to have infected about 18,000 computers globally, including machines in the UK, with estimated damages of £5.5m, according to the NHTCU. The two suspects have been bailed until the first week of April.

Deats said the unit would continue in its efforts to track down offenders, due to the serious nature of online crimes, and the potential cost to UK firms in lost business and downtime.

But security experts said the unit needs to step up its efforts, as the vast majority of virus writers and hackers are not caught. "The probability of getting caught is still negligible," said independent security expert Bob Ayers. "The people that do get caught are the victim of their own bragging about what they did to their friends, not clever police work."

Ayers added that the courts seem to be considering tougher sentences as a deterence. "The law has changed to make computer crime subject to heavier penalties and the courts are upholding it," he commented. "[But] the professional criminal or hacker won't get caught, so those that do manage to be unfortunate enough to be caught will be the amateurs."