Anna virus writer apologises

Onthefly, the author of the Anna virus which wreaked havoc around the world on Monday, has published a letter on his website apologising for writing the virus.

According to reports, he is also being investigated by ISP Excite@Home for allegedly misusing his membership to the website.

In the letter, which appears on a personal website hosted by Lycos subsidiary Tripod, and is signed "OnTheFly, The Netherlands", the author admits to writing the virus and explained that he "didn't do it for fun". He said that he used tennis star Anna Kournikova as bait because: "I am a big fan of her. She deserves some attention, doesn't she?"

He also placed some of blame for the virus's destruction on recipients who opened the bug-laden email attachment which is disguised as a digital image of Kournikova. "I never wanted to harm the people you [sic] opened the attachment," he wrote. "But after all, it's their own fault they got infected."

Meanwhile, somebody also using the name Onthefly in various virus discussion groups is being investigated by Excite@Home, which is understood to have such an individual named as a subscriber on its Dutch network.

Onthefly has previously been spotted on several virus newsgroups posting messages in Dutch about virus writing and claims to have written a worm called 'Iwa'. Richard Smith, chief technology officer at US privacy organisation, the Privacy Foundation, who has seen Onthefly's various messages and has made the connection between the author and Excite@Home, said: "He was sloppy and left his IP address which was traced back to Excite@Home."

A spokeswoman for the ISP confirmed that the company is attempting to seek out the subscriber. "We are investigating the matter and will take appropriate action," she said, adding that subscribers who misuse the service face having their membership terminated.

A spokesman for Lycos, which provides the Tripod website hosting facility, declined to comment on whether the company is also investigating the virus writer, who is using Tripod to host his website.

Researchers at various antivirus firms believe the style of the letter confirms that the author is a so-called script kiddie, probably a teenager who knows little about programming.

In his letter, Onthefly admitted to using a Visual Basic Worm Generator, written by K Alamar, which researchers say is a toolkit that allows novice programmers to write computer viruses. Onthefly wrote: "I have been using this programm [sic] because I don't know any programming languages."

"He sounds like a sad individual, who is very sorry," said David Perry, global director of education at antivirus software company, Trend Micro. "There is a sentence in the letter which reads: 'Maybe this is also Anna's blame, she is so pretty ...'. This looks like it was written by a 15 year-old."

Onthefly also apologised for putting the website of Dutch computer retailer Dynabyte at risk of a denial of service attack. The virus contains a code which would open an infected host's browser and send itself to Dynabyte's homepage, www.dynabyte.nl, on 29 January, putting the site at risk of crashing.

The letter continued: "I never meant to harm the site (tell me if I did). That's why I put the 29th of januari [sic] ... I'm sure that [the virus] is already stopped by then."

Finally, the author urged people to download antivirus software to help protect against the worm.