Kournikova virus slams U.S., Europe, misses Asia

Alleged virus writer speaks out

Anna Kournikova

In this story: Asia defends the Net 'Spread and burn quickly' RELATED STORIES, SITES

PALO ALTO, California -- A new Internet virus that masquerades as an image of a sexy Russian tennis star has spread through the United States and Europe, but much of Asia seems to have dodged the infection.

In the latest development, a message posted on the Internet Tuesday claims to be from the virus' originator.

"I admit writing the virus. In this letter I'd like you to know that I didn't do it for fun," states the posting.

Steve Gottwals, director of product marketing at F-Secure Inc.'s anti-virus center, said the Finland office of his firm received an anonymous e-mail at approximately noon EST on Tuesday that contained a URL pointing to the site. F-Secure is investigating the source of the message.

Although the author of the posting appears to have knowledge of the virus, Gottwals admits that it is nearly impossible to vouch for its authentication.

"It's hard to say," said Gottwals. "Someone may have taken over a site and posted it anonymously. As far as what the message is saying it's accurate. It's right."

The message on the Internet also explains why Anna Kournikova was chosen for the virus.

"Just because I am a big fan of her. She deserves some attention, doesn't she??" it reads.

It could be the biggest so-called worm since last year's "Love Bug" or "Love Letter" virus, which infected some 15 million computers and sent servers crashing around the world.

CHAT Allison Tom on the Kournikova virus   MESSAGE BOARD Security on the Net   ALSO Security firms warn of Valentine villains February 13, 2001 New e-mail virus preys on Anna Kournikova fans February 12, 2001

The "Anna Kournikova" virus infected computers in the United States late Monday and struck European businesses early the following day, computer security experts said Tuesday.

Yet companies in Asia were able to prepare for the e-mail clogging virus Tuesday and it failed to infect as many computers as the United States and Europe, security specialists said.

Internet security company Sophos in the United Kingdom said the virus appeared to have affected hundreds of thousands of computers in Europe, including many big companies.

"It is probably the biggest virus since the Love Bug. It went quiet overnight but took off again this morning when people started opening their e-mails," said Sophos' Graham Cluley.

The Love Bug virus, which spread in a similar manner, overwhelmed e-mail systems worldwide and caused tens of millions of dollars in damage after it was released in the Philippines in May.

Cluley said the virus writer skillfully exploited Kournikova's sex appeal and "the average fantasy of the guy who sits in front of the computer terminal."

The e-mail does not actually contain a photo of the tennis star. Moscow-born Kournikova, 19, is the world's ninth-ranked female tennis player.

Asia defends the Net

Asia seemed to have backhanded the virus. Governments in the region reported little or no impact.

"It was much worse in the U.S. because by the time Asia came to work, major companies had cleaned up the systems," said John De Riso, Taiwan spokesman for California-based Trend Micro Inc.

Australia was hit hard, however, with an estimated 100,000 computers infected by the e-mail.

Kenny Liao, Trend Micro's managing director in Australia, said the virus was detected early in the morning. Within hours the company knew of at least 50,000 Australian computer users who had been hit, based on a sample.

McAfee's World Virus Map, a Web site that tracks infected computers, said California was most infected by the Kournikova virus, and Asia and Africa were the least infected regions.

The Kournikova virus -- also known as "VBS," "SST" or "On The Fly" -- was first discovered in August and has been found in more than 50 large U.S. corporations, software company Network Associates said in a statement.

David Perry, global director of education for Trend Micro said users of his company's anti-virus software have reported 50 to 100 Kournikova hits per hour.

The subject line on the Kournikova virus email reads: "Here you have, ;o)." The text field reads "Hi: Check this!"

When users of Microsoft's Outlook e-mail software open the attachment, which is disguised as a photo file, the virus infects their computers and sends itself to every name in the users' address book.

'Spread and burn quickly'

"It's not dangerous in a sense that it's data destructive," said Vincent Weafer, of the Symantec Antivirus Research Center. The Kournikova virus and others like it are damaging because they have the potential to clog e-mail systems and crash servers. "They spread and burn very quickly, but die very quickly," he said.

Experts said the virus seemed to have been built from a programming tool kit created by a hacker known as "Kalimar."

The alleged virus writer claims to have little or no programming experience, and wrote in his posting that a computer kit called "Visual Basic Worm Generator" by "[K]Alamar" was used to create it. However, the author of the message says that "K" had nothing to do with the virus outbreak.

If the virus is not completely flushed from a computer, it will automatically connect to the Web site of a Dutch company called Dynabyte on January 26 each year, they said.

The alleged virus writer says this was done because, "at the moment of writing the virus I had the receipt in front of me, on my desk" from a recent purchase. The later date was meant to give the store time to download an anti-virus program, states the message.

The author of the Internet posting signs off as "OnTheFly, The Netherlands."

Virus watchers at Trend Micro also believe that a hacker in Holland who used the handle "On The Fly" wrote the Kournikova virus.

Others disagreed about the geographic origins of the virus, saying that the link to the Dutch company was likely a way to throw law enforcement off the hacker's scent.

Computer security experts advise Internet users to delete suspicious e-mails immediately and never open attachments from unknown parties.

"Surfing people haven't learned anything from the I Love You virus," the alleged Kournikova virus author writes.

Several security experts agreed with that sentiment.

"People still double-click on attachments," said Gottwals. "It's maddening. This virus was just an old trick with a new face and a nice pair of legs."

The Associated Press and Reuters and CNN.com Technology Editor Daniel Sieberg contributed to this report.

McAfee antivirus update gives NT 4.0 the flu
December 21, 2000
Office 2000 gets its own virus protection
December 4, 2000
MTX virus gaining speed in unusual ways
December 1, 2000
Experts predict more mutating viruses
October 31, 2000
Variant of 'I Love You' virus returns
October 24, 2000

Computer Associates International
F-Secure
Trend Micro
McAfee.com
Symantec
Message Labs

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.