Anna Kournikova (computer virus)

Anna Kournikova
TypeEmail vbs attachment
Point of originNetherlands
Author(s)Jan de Wit
Written inVBScript

Anna Kournikova (named by its author as "Vbs.OnTheFly Created By OnTheFly") was a computer worm written by a 20-year-old Dutch student named Jan de Wit --who called himself 'OnTheFly'-- on February 11, 2001. It was designed to trick email users into opening a mail message purportedly containing a picture of the tennis player Anna Kournikova, while actually hiding a malicious program. The worm arrives in an email with the subject line "Here you have, ;0)" and an attached file called AnnaKournikova.jpg.vbs.[1] When launched under Microsoft Windows the file does not display a picture of Anna Kournikova but launches a viral Visual Basic Script that forwards itself to everybody in the Microsoft Outlook address book of the victim.

OnTheFly created Anna Kournikova using a simple and online available Visual Basic Worm Generator program by an Argentinian programmer called [K]Alamar.[2] While similar to the ILOVEYOU worm that struck a year earlier in 2000, the Anna Kournikova worm did not corrupt data on the infected computer.[2] Still, it affected millions of people and caused problems in email servers around the world.[3]

Apparently, the author created the worm in a matter of hours. "The young man had downloaded a program on Sunday, February 11, from the Internet and later the same day, around 3:00 p.m., set the worm loose in a newsgroup."[4] De Wit turned himself in to authorities in the town of Sneek located in the northern Dutch province of Friesland. "By the time he understood what the worm did, he had conferred with his parents and decided to turn himself in to the police."[4]

The efforts of virus writer working undercover for the FBI, David L. Smith (author of the Melissa virus, who was still serving his sentence) assisted in tracking down OnTheFly's real identity.[5] De Wit turned himself in to the police in his hometown Sneek on February 14, 2001,[6] after he posted a letter of confession on a website and a newsgroup of player Anna Kournikova (alt.binaries.anna-kournikova) dated February 13. In it, he admitted creating the virus using a toolkit and explained his motivations as to see whether the IT community had learned their lesson to better secure systems in the aftermath of previous virus infections. But besides admission and regret he also attributed external blame for the rate of spreading on the beauty of the tennis player (he had pinups of her on his website) and blamed those who opened the email, writing "it's their own fault they got infected."[2]

Resembling the cases of other computer virus writers, a few days later the mayor of Sneek, Mayor Sieboldt Hartkamp made a tentative job offer to De Wit in the local administration's IT department, saying the city should be proud to have produced such a talented young man.[7]

De Wit was tried in Leeuwarden and was charged with spreading data into a computer network with the intention of causing damage, a crime that carried a maximum sentence of four years in prison and a fine of 100,000 guilders (US$41,300).[8] The lawyers for Jan de Wit called for the dismissal of charges against him, arguing that the worm caused minimal damage. The FBI submitted evidence to the Dutch court and suggested that US$166,000 in damages was caused by the worm. He denied any intent to cause damage. De Wit was sentenced to 150 hours of community service.[8]

The 18-year-old Buenos Aires programmer who created the Worm Generator toolkit, removed the application's files from his website later in February 2001. "Once they heard my alias being mentioned on television, my friends recommended that I do so," he told ZDNet Latin America in an interview.[9]

In popular culture

In the Friends episode "The One in Barbados, Part One", Ross Geller's laptop was infected by the Kournikova worm when Chandler Bing checked his email on it. The version of the worm in the episode was more malicious than the real thing, as it deleted Ross' entire hard drive, including his speech on paleontology, when it was opened. Moreover, the computer was a PowerBook G4, with which Windows-targeting malware would not be compatible.