Virus writer steals £70,000 in three days

The creator of the Marq premium rate email worm has narrowly dodged a jail sentence, but faces a €3,000 fine from an Italian court.

The man wrote a computer worm which netted him €100,000 by illegally rerouting internet connections to offshore premium phone numbers.

If he had not agreed with the court in Milan to pay the fine, he would have been imprisoned for 14 months.

The Marq-A email-aware worm (also known as Voltan or Zelig) directed innocent computer users to a website where a malicious program posing as a screensaver could be downloaded.

If run, the worm changed the phone number used for accessing the internet to a premium rate number based in Aruba in the Dutch Antilles at a cost of €1.8 per minute.

It is claimed that more than 57,000 minutes were logged on the number in just three days at the end of October 2003. If the virus had been allowed to continue, it is estimated that €1.2m would have been stolen every month.

The Italian financial police were able to freeze the money accrued by the worm, which was first sent to a New York bank account, then transferred via Venezuela before ending up in an account belonging to a 'ghost' company in Aruba.

The crime was discovered and blocked after the virus writer, who although born in Pisa lives in Venezuela, came to Italy to increase the number of premium rate telephone connections.

"More virus writers are being caught and convicted than ever before, and the Italian authorities did well to cut this worm's author down to size," said Graham Cluley, senior technology consultant at Sophos.

"Increasingly we are seeing viruses and worms which are designed to steal money or resources from the infected computers of innocent people. Everybody should make the defence of their computers a priority if they wish to connect to the internet."

The Marq worm arrived in the form of an email with the subject line 'The moment is cathartic', written in Italian, directing users to download what was claimed to be a screensaver called zelig.scr.

Flavio Oreglio, one of the stars of the Italian TV comedy show Zelig, is the author of a book called The Moment is Cathartic and it is suspected that this encouraged some Italian-speaking people to download the malicious program.