As ammusing as some...or rather many of the responces are, they're just not realistic. One comes to mind of 50 years in prison no parole.

If found, people who create the programs/distribute the programs, whether it be a virus, trojan, etc; Should be punished, but perhaps even 5 years is too much. It would end up costing more to keep the people in jail than it would be worth. Someone else suggested having them be used as detectives to route out others. This is a good idea and if it can be done it should be by all means. If a prison sentence is determined for them this method could be used to reduce their time. But instead of an extreme of 50 years being reduced by 1 year for every 3 groups/people found maybe 3 years reducing a month or so for tracking down the others.
Instead of a fine, their belongings could be taken from them. Perhaps all their electronics could be disposed of. Or as someone else mentioned, drain their bank accounts and redistribute the money to victims (though since the government would likely be doing this it may be just as well to use the money to eliminate some of our steps...)
Truely the easiest method is simply to put a bullet or two in them, but as decent people, who are not going to act like the Nazi Gestapo, this isn't really an option.
Severing the nerve passages to their index and middle fingers might be an interesting deterrant too. While it would ruin their dexterity, it would still allow them to function, though they would bare a visible reminder to all that malicious acts are not tollerated.

Terms and punishments would vary depending on sevarity, of course.