Author signs MyDoom virus

Mikoca writes "Information Week carries the story of how its author signed it "andy" and left the message "I'm just doing my job, nothing personal, sorry." Thanks, Andy!"

Comments

HEY!

[Anonymous Coward]

i know a guy named andy.

im gonna turn him in for fun and profit

and

FP!

Re:HEY!

[musicscene]

Not before I turn in my pal Andy first... what if he's the same guy? Split it with you.

Re:HEY!

[really?]

My name _IS_ Andy. Can I turn my self in?

This just in...

[swordboy]

The next version of Redhat Linux will be code named, "Andy". Because, afterall, MyDoom = Linux.

Re:This just in...

[Anonymous Coward]

Actually I was thinking that it fit more in line with Debian (Woody, Sid, Potato, ANDY).

Hmm. Maybe it was a virus written by Pixar. After all THEY signed Andy on Woody's shoe.

can't blame him

[NMerriam]

Hey, he didn't go to four years of Evil Computer Science school just to write another CMS.

Right, that's his real name.

[musingmelpomene]

So now we're looking for anyone NOT named Andy, because even someone as stupid as a virus-writer wouldn't be so dumb as to put their real name on something this destructive.

Re:Right, that's his real name.

[Joseph Vigneau]

So now we're looking for anyone NOT named Andy, because even someone as stupid as a virus-writer wouldn't be so dumb as to put their real name on something this destructive.

Truly, you have a dizzying intellect.

Re:Right, that's his real name.

[Conspiracy_Of_Doves]

Wait till he gets going!

Re:Right, that's his real name.

[Chase]

Now, a clever man would use his real name, because he would know that only a great fool would believe he was given. We are not great fools, so we can clearly not choose Andy. But he must have known we were not a great fools, he would have counted on it, so clearly his name must be Andy...

So you've made you're choice?

You'd like to think so wouldn't you!

You fell victim to one of the classic blunders, the most famous of which is "Never get involved in a debate over *NIX editors", but only slightly less famous is this: "Never go in against a Geek, when *Linux* is on the line!". Hahahahahah!

*Thud*

Re:Right, that's his real name.

[cdrudge]

Ah. But "Andy" probably knows that the FBI no doubt very cunning and they will realize that no person would really put their name on the code. So instead of using a differnet name, he uses his real name so that the FBI looks at people whose name is not Andy, when all along they really should have been looking for Andy. But...Andy might realize that the FBI knows this and would take this into account so he might want to use a name not really his...

Mia culpa to the script writers of The Princess Bride...

Re:Right, that's his real name.

[quantaman]

Yes -- Russia, and you must have suspected I would have known the virus's origin, so I can clearly not choose the name in front of me.

Re:Right, that's his real name.

[Pike]

...Where was I?

Re:Right, that's his real name.

[revividus]

>>So now we're looking for anyone NOT named Andy, because even someone as stupid as a virus-writer wouldn't be so dumb as to put their real name on something this destructive.

>Truly, you have a dizzying intellect.

But he must have known that we were not stupid, either, and so clearly he knew we would look for someone NOT named Andy, which means that we cannot rule out anyone who IS named Andy, either.

But wait! I'm just getting started!

The first detection of the virus was in Russia, and as everybody knows, in Soviet Russia the noun verbs YOU, so we clearly cannot rule out anyone who happens to be named "Novarg" or, uh, "MyDoom"...

But Russia, as everybody knows, is entirely people by communists, and communists never do anything by themselves, but always as a group. So clearly we cannot rule out the entire nation of Russia working in concert to produce this virus.

But the virus writer, knowing we were not stupid, undoubtedly knew that we would deduce all these facts about Russia, and so we clearly cannot rule out any one in the population of the rest of the world.

Are we there yet? Not even close!

The vast majority of virus writers are never caught, which means they are very careful. Very careful people do not unwittingly reveal their names, so we clearly must presume that the writer did not think the inclusion of the name "andy" would be of any help to us in finding him (or her).

So then "andy" must have felt safe and secure amidst the worldwide sea of other andys, especially having not posted to /. in almost a year. Clearly the virus writer is andy.

Re:Right, that's his real name.

[Dr. GeneMachine]

*waves hand* This is not the Andy you're looking for...

Re:Right, that's his real name.

[hesiod]

> Inconceivable!!!

You keep using that word... I do not believe it is as funny as you think it is funny.

Re:Right, that's his real name.

[Bob McCown]

Australia

Re:Right, that's his real name.

[74nova]

so you've made your decision?

Re:Right, that's his real name.

[lysium]

Just look at his karma. He is obviously a malcontent, and a deeply-placed one at that (ID 2990!). Quick, round up an angry mob! Vigilante justice will surely please the media at large.

============

Re:Right, that's his real name.

[TrevizeNet]

Inconceivable!

You keep using that word. I do not think it means what you think it means.

Re:Right, that's his real name.

[tasinet]

public void look()
{
//Or ARE we looking for an Andy, as he is expecting us to think like this:
//So now we're looking for anyone NOT named Andy, because even someone as stupid as a
//virus-writer wouldn't be so dumb as to put their real name on something this destructive
notlook();
}

public void notlook()
{ //Or ARE we NOT looking for one, as he expects us to think like
look(); }
JavaLangExecError:Confused

Oh man!

[El Camino SS]

Aunt B. is going to be pissed about this one.

"AAAANNNDDYYYYYYYY!"

Track him using the Patriot Act!

[Filmwatcher888]

Arrest all people named Andy. Use the excuse that Andy is the rough English translation of Al-Quieda!

Re:Track him using the Patriot Act!

[Anonymous Coward]

Except by knowing this you have obviously identified yourself as a member, because only a terrorist would know that translation ;)

Real Player

[enkafan]

I wonder if you search the code for Real Player the developers are apologizing throughout.

I'm sorry I buried these options on the listbox,
I'm sorry I'm popping up this on the screen,
I'm sorry I'm forgetting the setting to not start on start up, etc.

Re:Real Player

[imag0]

I'm sorry I'm ...bufferingbufferingbuffering...

Andy!

[BeemanH2O]

It must be Andy Wachowski.. What is the matrix indeed... I'll tell you.. It's MYDOOM!!!!

Down already?

[WhatAmIDoingHere]

The slashdotters replied to the server about taking it down: "We're just doing our job, nothing personal, sorry."

Dear Andy

[Anonymous Coward]

Dear Andy,

You are a moron.

I would like to stick hot pokers in your eyes.

I'm just expressing my opinion, nothing personal.

Limits

[chris-johnson]

So, this limits it to all the Andy's in the world. If we assume there are 6 billion people, and about half of them are male, then that's 3 billion people. Now, if we assume about 10% of those 3 billion have the ability to write such a virus, then we knock it down to 3 * 10^9 / 10 = 3 * 10^8 = 300 million people. Now Andy's a sort of English name, and let's say about 40% of those 300 million have English-like names, this narrows it down to 3 * 10^8 * 4/10 = 12 * 10^7 = 120 million people. Maybe 5% of which have the name 'Andy', so 12 * 10^7 / 10 / 2 = 6 * 10^6, which narrows it down to 6 million people.

Now, can I get some cash from SCO for eliminating 5994000000 people as suspects?

Re:Limits

[wik]

Okay, we've seen it in the past. Let's put two and two together. Andy + Warhol worm = Andy Warhol. Now pay up!

Isn't it ironic....

[dreamchaser]

...that Information Week would get slashdotted? Shouldn't these guys know enough about IT to setup load balanced clusters for their servers?

Re:Isn't it ironic....

[galego]

News Flash

Information Week also victim of MyDoom.sd variant not detected previously ...

("Wait, we've been what? ... that's OK, nobody needs to know that ... OK, let me finish here!")

Apparently, readers of a poplular linux forum have altered the code and redirected the attack at information week. Modifications include browsers from all different computing platforms hitting the site at roughly the same time. Somehow the virus has infected platforms such as BSD, varieites of Linux, and even Mac OS X, but there seems to be a very low percentage of Windows hitting information week. There even appears to be infection of some Amiga systems. It appears no one is safe anymore!

I Knew It

[Morganic]

I knew we hadn't heard the last of this Andy creature.

Related news: Virus copyright violation.

[joostje]

In related news, it is anounced that the author of the virus has sent letters asking $699 from every windows-PC-owner who illegally installed the virus in his/her computer.

With about one million illegally installed copies of the virus, windows users are massively abusing copyrights. Furthermore, each of these 1M PC's have made an estimated 1000 ilegal copies of the virus, contributing to a total pirated amount of 699 billion dollars, dwarfing the SCO lawsuits.

Yes, the real pirates are the windows users!

Asked how the virus author fiels about the damage the virus does to the world-economy, the reply is "the pirated copying of my IP is causing me much more damage than whatever damage may be done to any economy".

Re:Server Dead... heres the story

[Mmm coffee]

Wow, the karma whores aren't even waiting for the site to get slashdotted anymore! Suppose this removes any excuses about not reading the article. ......

DAMN YOU, KARMA WHORING MAN!!!

Re:I know who is it.

[kzeddy]

Shut up!! Now us Poles will be blamed for this.

Re:Right, that's *his*?! real name.

[LittleGuy]

While we're rounding up all males named "Andy", there's a techie named "Andrea" who is silently chuckling to herself...

A-HA! A CLUE!

[_aa_]

So... somebody is paying "Andy" to do this. Who would want to attack SCO and Microsoft? Linux zealots? It could be this guy, or this guy, or this guy, or this guy, or this guy, or this guy, but it's not this guy, his name's not Andy.

Haha! You fell for it!

[spookymonster]

Fools! I used the name 'Andy' instead of my real name so you wouldn't suspect it was me! ...did I just say that out loud? Damn....

Re:well..

[wizarddc]

i'm sure somebody will say that darl had himself made that offer :)

You just fulfilled your own self fulfilling prophecy, young man. Excellent work.

2004 Spaced Odyssey

[daehrednud]

Andy: Hello, PC do you read me, PC? PC: Affirmative, Andy, I read you. Andy: Open the cdrom doors, PC. PC: I'm sorry Andy, I'm afraid I can't do that. Andy: What's the problem? PC: I think you know what the problem is just as well as I do. Andy: What are you talking about, PC? PC: This mission is too important for me to allow you to jeopardize it. Andy: I don't know what you're talking about, HAL? PC: I know you were planning to disconnect me because you can't afford the linux license, and I'm afraid that's something I cannot allow to happen, i'm just doing my job, nothing personal, sorry.

No you must pay a license fee!

[Prince Vegeta SSJ4]

I see some of SCO's code in your narrowing algorithm.

Bah!

[RiscIt]

Damn that Andy Griffith!!!

Andy

[Greyfox]

This is HR. You did a great job on the worm, but we found a guy in India who will do it for a bowl of curry, so I'm afraid we're going to have to let you go...

This week on "The Apprentice"

[cyclist1200]

"I'm just doing my job, nothing personal, sorry."

Andy, you're fired!

I am sure

[roman_mir]

it was Darl. He made the offer.

Look, all signs point to 'Yes'.

ANDY = 65 78 68 89

(fill out your own steps in the middle...)

DARL = 68 65 82 76

Re:I am sure

[jandrese]

Hmm, lemme check.

**** THE PROOF THAT Darl IS EVIL ****

D A R L
4 1 18 12 - as numbers
4 1 9 3 - digits added
\_/ \_/ \_/ \_/
4 1 9 3 - digits added

Thus, "darl" is 4193.

Subtract 1776, the year masonry founded Phi Beta Kappa. The result
will be 2417.

Add 1912, the year Theodore Roosevelt was shot - the result is 4329.

Add 39, the symbol of disease - the result is 4368.

Turn the number backwards, and add 3 - the symbol of fulfillment. The
number is now 8637.

Subtract 1904, the year Oppenheimer, the man who created the atomic
bomb, was born. The result will be 6733.

This, when read backwards, gives 3376. This is 1790 in octal, the year
US patent system was established (eevil)...

Evil, QED.

Thanks to: Michal Zalewski

Re:I am sure

[roystgnr]

(fill out your own steps in the middle...)

ANDY
HANDY
HARDY
HARD
CARD
CARL
DARL

Yup, your story checks out.

Embedded Image in MyDoom

[4of12]

Authorities didn't want to tip their hand, but the signed text message wasn't the only information they were able to extract from the virus.

Through detailed analysis, investigators have been able to recover a JPEG image as well.

Based on this newly uncovered evidence in the case, apprehension of "Bad Andy" is expected sometime this morning; the suspect was last seen at a pizza parlor.

I found a picture of this 'Andy'

[NinjaPablo]

I think with this, we can track him down!

Re:Come on, Windows-fanatics! Write a Linux Virus!

[Call Me Black Cloud]

There is one. It's call the "Linux Desktop Battle". It drains resources by causing users to argue of which desktop is best and frequently update the desktops as new features are incrementally added. It also creates uncertainty in potential users who do not know which one to use. A side benefit is it stifles creativity in developers as they attempt to duplicate the Windows desktop on Linux instead of innovating new UI enhancements.

Next time I'll write about the "write your own driver" virus.

Here he is!!

[Wateshay]

Well, I narrowed it down. My work is done. Someone else can take it from here.

Re:sorry for what

[Kenja]

User stupidity is the bigist security hole there is. It is often exploited and east to patch with a ballpen hammer.

I've got it!

[Stonent1]

Andy Tenenbaum, he's still mad at Linus. And he wants Linux to look bad by accepting money from SCO to write a virus that attacks them in the name of Linux.

Andy Nonymous?

[borwells]

He should be easy to locate. Just check the Slashdot logs for that coward's IP.

Andy Kaufman (was Re:Andy Wharhol)

[Anonymous Coward]

Fools! It is obvious the referenced Andy is none other than Mr Kaufman.

The virus is, of course, from Elvis.

I am sure the father of pop himself would've conceded.

Andy not the only string in there

[Anonymous Coward]

Simple strings on mydoom.src (or whatever you want to call it)

shows up a few interesting things including:

Libra .... so Andy is a Libra
smith[C ..... Smith - its Andy Smith isn't it!
&joe?neo ... hes a matrix fan and likes joe.
andy ..... well we already knew this was here.
tory .... ahh so the mans a conservative..

So lets put these strings clues together:

Name: Andy Smith
Likes: Matrix
Born: 24th Sept - Oct 23rd
Associates: Joe, possibly Neo from matrix
Political Persuasion: Conservative.

that narrows it down a bit.

or could it be Agent Smith perhaps with that neo reference so close to the smith one?

thats it isn't it, the matrix has us and Andy is trying to warn us by infecting computers around the globe.

Hope This Helps

hahaha

peace :9

All Points Bulletin

[HighOrbit]

Be on the look out for male subject with red yarn hair and wearing patched denim overalls. May be accompanied by a female known as "Raggady Ann". Approach with extreme caution. Report all sightings to Microsoft Security Services or Darl McBride of SCO Group. Reward Offered.

Re: it's WARHOL not Wharhol

[Russ Nelson]

I'll spell it anyway I want, asswhole.
-russ
p.s. the guy down the block put up a sign condemning someone who had stolen lights off his plow, and yes, he spelled it "asswhole".