Suspected 'Anna' virus writer turns himself in to Dutch police

A 20-year-old man who lives in the Netherlands turned himself in to police in the Dutch province of Friesland today, saying he was the author of the virus disguised as an image of tennis player Anna Kournikova that hit numerous e-mail systems on Monday.

Robert Rambonnet, a police spokesman in the Netherlands, said the unidentified man was arrested and then released. "He made a statement about his actions, what he had done, how he made the virus and published it on the Internet," Rambonnet said, adding that the man's computer equipment had been confiscated as part of the arrest.

According to Rambonnet, the suspected author of the Kournikova worm said in his statement to police that he "made a virus to prove how simple it was to make [one], and how vulnerable computers are for viruses." Rambonnet would give no further details about the man's identity or occupation, other than to say he's a resident of the Dutch town of Sneek.

But Rambonnet added the man in all likelihood is the same person who took responsibility for the virus yesterday in a Web posting that identified the author by the user name "OnTheFly." That's one of several aliases for the Kournikova worm that were listed by antivirus software vendors after its rapid spread began (see story).

"I didn't do it for fun," yesterday's posting said. "I never wanted to harm the people [who] opened the attachment. But after all: It's their own fault they got infected with the [virus]."

An e-mail inquiry sent to the address listed for OnTheFly was returned with an error message stating that the account had been disabled. A spokeswoman at Amsterdam-based At Home Benelux BV, the Internet service provider that hosted the e-mail address, said the company is investigating whether OnTheFly was indeed one of its users.

The Visual Basic Script virus, which was written to take advantage of Microsoft Corp.'s Outlook e-mail software, is spread via an attachment that purports to be a .JPG image of Kournikova. The attachment, which is named AnnaKournikova.jpg.vbs, arrives with a subject line reading "Here you have, ;o)" and a message that says "Hi: Check This!"

Security analysts have said that the virus doesn't destroy or corrupt files when it's activated. But the worm does replicate itself to all of the people listed in the e-mail address books of users who open the attachment, and the volume of messages generated when that happens clogged some e-mail systems before spread of the virus was controlled (see story).

Risto Siilasmaa, president and CEO of antivirus vendor F-Secure Corp. in Espoo, Finland, said in a statement today that some companies received "thousands of bogus messages" because of the e-mail virus. "You don't prove someone is ill-protected by attacking them," Siilasmaa said. "As a result of this irresponsible conduct, many e-mail servers were shut down, leading to a decrease in productivity, a slowdown in customer service and other unknown impacts."

In addition, Siilasmaa said, the spread of the Kournikova virus shows that many companies still haven't adequately protected themselves by taking steps such as disabling Visual Basic's scripting capabilities. "The danger posed by viruses is in direct proportion to the complacency that seems so prevalent today [among users]," he said.

Related stories:

For more coverage of this issue, visit Computerworld's Security Watch page.

Copyright © 2001 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon