- I think this was sent to the old address. Please excuse the duplicate if
you get one.
Although attachments are stripped when sent to S-R, I thought members of a
Slavic mailing list might be caught unaware (because of its name) by this
new worm. I'm not certain if the .vbs following the .jpg is visible when
you check the attachment.
VBS/SST@MM (AnnaKournikova Virus) Help Center
VBS/SST@MM is a HIGH-RISK virus that is spread using the Windows email
program Outlook. The infected email can come from addresses that you
recognize. Attached is a file name AnnaKournikova.jpg.vbs. When run, the
script copies itself to the WINDOWS directory as "AnnaKournikova.jpg.vbs".
It attempts to mail a separate email message, using MAPI messaging, to all
recipients in the Windows Address Book using the following information:
Subject: Here you have, ;o)
It also creates a registry key and key values. The script refers to these
values to check if the mailing routine has already taken place:
HKEY_USERS\.DEFAULT\Software\OnTheFly\mailed=(1 for yes)