Technology staff at several school districts across the country were forced to work longer hours Feb. 12 after being overwhelmed by a computer virus disguised as an electronic photo of teen-age tennis star Anna Kournikova.

The virus slowed down eMail systems and forced some school systems to shut down their eMail altogether while they cleaned out the rogue program. Security experts said the virus does not permanently damage computers.

After the New Hampshire Department of Education received several infected eMail messages Monday afternoon, technology staff shut down their eMail server between 4 and 9 a.m. to install the latest anti-virus software.

Lori Anzini, director of technology at Pittsburg Unified School District in Pittsburg, Calif., said although she warned 800 eMail users not to open the virus, the district was still infected.

“I ‘cleaned’ one machine last night around 10 p.m. and [kept] the problem from spreading,” Anzini said. “Hopefully, no more infections will happen.”

Pat Hartley, coordinator of school services at Evergreen School District #114 in Vancouver, Wash., said the virus was sent to his district more than 60 times, but the district’s anti-virus software kept its computers from becoming infected.

Within a few hours, the virus had managed to spread almost as rapidly as last May’s “I Love You” virus, which caused tens of millions of dollars in damages worldwide. Anti-virus researchers expected more computer infections during the Feb. 13 business day in Asia.

“Everybody and their brother and sister-in-law [are] infected with this thing,” said David Perry, director of public education at Trend Micro Inc. “Last year, everybody wanted to be loved. Apparently, many people want to see a JPEG [picture] of Anna Kournikova.”

Graham Cluley, senior technology consultant at Sophos Anti-Virus Inc., said the virus writer skillfully combined “the temptation of the teen-age tennis star with the average fantasy of the guy who sits in front of the computer terminal.”

The virus is known as a worm because it can automatically send copies of itself to everyone on a recipient’s address book. That could be thousands of copies per person for a larger corporation.

It only spreads through Microsoft Outlook eMail software on Windows computers, although Macintosh users and those using other eMail programs can still spread the virus manually.

Microsoft spokesman Adam Sohn said the company had released a security update last June, shortly after the “I Love You” virus spread using similar techniques. That update generates a warning anytime a computer program attempts to access Outlook’s address book.

The virus appears to have originated in Europe.

Mikko Hypponen, manager of anti-virus research for F-Secure Corp., said the virus, if left alone, will try to contact a Dutch web site on Jan. 26, 2002.

The virus comes as an attachment named “AnnaKournikova.jpg.vbs” and carries the message “Hi: Check This!” At least three subject lines have been identified: “Here you have,” “Here you go,” and “Here you are”—all followed by a smiley face.

Many anti-virus companies have developed software updates to filter the new virus, and network administrators responded by configuring eMail servers to automatically reject the message.

A warning to Michican State University users was typical: “If you receive such a message, please DO NOT OPEN the attachment. Discard the message immediately.”

Vincent Weafer, director of the Symantec Anti-Virus Research Center, partly attributed the virus’s spread to timing.

“Close to Valentine’s Day, anything novel or different like this will get people’s attention more than normal,” he said. “They are expecting messages from friends, maybe pictures of each other or cards. People lower their guards.”

Links:

F-Secure
http://www.fsecure.com/virus-info

Microsoft Corp.
http://www.microsoft.com