The ''virus'' program that has plagued many of the nation's computer networks since Wednesday night was created by a computer science student who is the son of one of the Government's most respected computer security experts.
The program writer, Robert T. Morris Jr., a 23-year-old graduate student at Cornell University whom friends describe as ''brilliant,'' devised the set of computer instructions as an experiment, three sources with detailed knowledge of the case have told The New York Times.
The program was intended to live innocently and undetected in the Arpanet, the Department of Defense computer network in which it was first introduced, and secretly and slowly make copies that would move from computer to computer. But a design error caused it instead to replicate madly out of control, ultimately jamming more than 6,000 computers nationwide in this country's most serious computer ''virus'' attack.
The dent's program jammed the computers of corporate research centers including the Rand Corporation and SRI International, universities like the University of California at Berkeley and the Massachusetts Institute of Technology as well as military research centers and bases all over the United States. Meeting with the Authorities
The virus's creator could not be reached for comment yesterday. The sources said the student flew to Washington yesterday and is planning to hire a lawyer and meet with officials of the Defense Communications Agency, in charge of the Arpanet network.
Friends of the student said he did not intend to cause damage. They said he created the virus as an intellectual challenge to explore the security of computer systems.
His father, Robert T. Morris Sr., has written widely on the security of the Unix operating system, the computer master program that was the target of the son's virus program. He is now chief scientist at the National Computer Security Center in Bethesda, Md., the arm of the National Security Agency devoted to protecting computers against outside attack. He is most widely known for writing a program to decipher symbols, or ''passwords,'' that give users access to computers and their data. 'Very Well Trained'
The elder Mr. Morris, in a telephone interview yesterday, called the virus ''the work of a bored graduate student.''
Speaking in the presence of officials and lawyers of the National Security Agency, he would not discuss the case in detail. He said his son was ''for his age very well trained in computer science: he studied it in college and held various summer jobs at various places.''
The sources said the 56-year-old Mr. Morris had no prior knowledge of the virus attack.
Mr. Morris said he believed that the virus might ultimately have a positive effect. ''It has raised the public awareness to a considerable degree,'' he said. ''It is likely to make people more careful and more attentive to vulnerabilities in the future.''
Managers at hundreds of research and military facilities around the country yesterday continued efforts to cleanse their systems, while computer scientists studied the virulent program in an effort to prevent a recurrence. Several computer sites were spared from the virus because system managers had rewritten security programs in light of at least three separate security flaws in computers running the Unix operating system. Most of the loopholes have only recently been discovered.
One site that escaped infection was the American Telephone and Telegraph Company's Bell Laboratories. Computer scientists there said the program with the principal flaw was rewritten about a year ago. Exploitation of Flaws
The student's virus, actually a group of small programs, entered systems by exploiting the flaws, said Clifford Stoll, a computer security expert at Harvard University. Once it entered a given computer it was designed to hide itself in the computer's memory then systematically search for ways to enter other computers linked through communications networks.
Computer viruses are the computer equivalent of biological viruses, replicating largely on their own and spreading from computer to computer, consuming computer processing power and storage space or potentially destroying stored information.
The virus was detected in part because a design error led it to create many copies rather than a single copy on each machine it attacked. Computer researchers said the copies were like echoes bouncing back and forth off the walls of canyons.
Computer experts who were assessing the harm yesterday said there seemed to be no damage other than the thousands of hours that computer scientists and programmers were spending removing the program from their systems. 'Classic Hack That Went Wrong'
The program eventually affected as many as 6,000 computers, or 10 percent of the systems linked through an international group of computer communications networks, the Internet.
''This sounds like a classic hack that went wrong,'' said Mark Seiden, a computer scientist who is an expert on the Unix operating system.