Jeffrey Lee Parson admitted creating the "MSBlast.B" variant, also called "teekids," by modifying the original version of the worm and adding a backdoor that granted him control of infected computers, federal prosecutors said.
"Sending out a computer worm may be viewed as a harmless prank," John McKay, a U.S. attorney, said in a statement. "But the damage to individual computer users is very real, and the penalties are also very real."
Sentencing is scheduled for Nov. 12 in Seattle before U.S. District Judge Marsha Pechman. Parson could face between 18 and 37 months in prison on the charge of intentionally causing damage to a networked computer, plus possible restitution in the millions of dollars.
Parson was arrested in August 2003, just two weeks after the MSBlast worms began tunneling into hundreds of thousands of computers running Microsoft Windows. Microsoft had fixed the bug in July, but many Windows users were exposed to the malicious worm because they had not downloaded the patch.
How many computers were infected by the MSBlast.B variant is in dispute. Prosecutors claim the number is more than 48,000, but defense attorneys say the figure is lower. The number could affect the length of any prison sentence.
According to court documents filed last year, FBI agents traced traffic that the Blaster worm generated back to a Web site with a name that resembled Parson's online alias of "teekids." The site allegedly had source code for other worms, including one designed to spread via file-sharing networks.
