As noted, the Anna Kournikova virus was a worm. Its behavior was much like that of a foregoing virus, the Melissa virus, in that it was designed to duplicate itself by crawling a recipient’s inbox and emailing itself to everyone in the address book. But unlike Melissa, which is technically not a worm, the Anna Kournikova virus did not inflict damage on local machines. Whether it disrupted networks can be debated, but it certainly had no payload nor did it aggregate any data.
The email attachment responsible for duping recipients was “AnnaKournikova.jpg.vbs.” JPG, which is short for Joint Photographic Experts Group, is a common file extension used for displaying digital images. Photos of Anna Kournikova were highly searched in that day, which may have helped in the spreading of De Wit’s worm. But the letters “JPG” were actually a part of the email attachment’s name; its actual file extension was VBS, short for Visual Basic Scripting Edition. The email attachment was the product of Microsoft scripting technology, and ultimately how the Anna Kournikova virus would be invoked.
Creation of the Anna Kournikova Virus
Jan de Wit used a Visual Basic virus builder that was readily available online to build the Anna Kournikova virus, which purportedly took a mere couple of hours. It was published in February 2001, a few months shy of the first anniversary of the ILOVEYOU virus. It was De Wit’s contention that computer users and the Information Technology (IT) industry as a whole had not learned anything from previous viruses.
Although David L. Smith, creator of the Melissa virus, reportedly provided the FBI with De Wit’s real name and home and email addresses, the matter was beyond the scope of federal jurisdiction. The FBI, therefore, passed this information along to Holland authorities and De Wit was in police custody by February 14th, in his hometown of Sneek, Friesland. Reports vary as to whether he was apprehended or turned himself, but his detainment followed a confession to the same Anna Kournikova newsgroup he dispensed his virus to. And despite his confession, he maintained that users were ultimately at fault for opening the email in hopes of viewing an image of the Russian beauty.
According to court documents released nearly two years later, Smith testified that he had online conversations with De Wit, who confessed to him he was “OnTheFly,” the author of the Anna Kournikova virus which he originally named “Vbs.OnTheFly Created By OnTheFly.” Such conjecture and hearsay would not have been admissible in a United States court, as there is no tangible way to verify the identity of anyone you are communicating with in an online forum.
Even if you traced an Internet Protocol (IP) address, it is important to understand that most residential IP addresses are dynamic (meaning that sometimes their third and fourth octets will change), and that it is difficult to pinpoint who uses a computer at a given time. Smith supposedly had these conversations with De Wit from his own prison cell in Ft. Dix, New Jersey. However, it did not help that Jan de Wit owned a website that used his “OnTheFly” moniker. The website allowed users to download pictures of Anna Kournikova, and its hosting was registered in De Wit’s name.
The future looked quite bleak for De Wit. Even though Sieboldt Hartkamp, then-mayor of his hometown, had “come around” and offered him a job in his administration’s IT department, De Wit faced four years in prison and a 100,000 guilder fine (41,300 USD). Nevertheless, in a surprise move, the judge also came around and sentenced De Wit to 150 hours of community service instead.