Virus Outbreak - AnnaKournikova.jpg.vbs scripting Virus! (2/12/01)

Question

Major Virus Outbreak - AnnaKournikova.jpg.vbs scripting Virus!

Answer

This question was answered on February 12, 2001. Much of the information contained herein may have changed since posting.

A major virus outbreak has occured that is based on the VBS (Visual Basic Script) family of code.

The "AnnaKournikova.jpg.vbs" virus will look like the following:

Subject: Here you have, ;o)

Body:

Hi:

Check This!

Attachment: AnnaKournikova.jpg.vbs

DO NOT OPEN THE FILE ATTACHMENT, IT IS NOT A PICTURE OF ANNA KOURNIKOVA!

If you have updated your anti-virus program in the past 3-4 months, you most likely have protection in place. If you have not updated recently, do so immediately.

This virus is spreading like wildfire because it automatically sends itself to everyone in the Windows Address book of an infected machine.

THE TECHNICAL DETAILS:

It creates a registry key and key values. The script refers to these values to check if the mailing routine has already taken place:

HKEY_USERS\.DEFAULT\Software\OnTheFly

HKEY_USERS\.DEFAULT\Software\OnTheFly\mailed=(1 for yes)

<a href="http://computerproblems.com/answer.cfm?AnswerID=16838&QuestionID=16900&CatID=38"><font color="#003399">Our previously published tips for defending your system against this class of virus/worm can be found by clicking here!</font></a>

Author

Posted by Ken of Data Doctors on February 12, 2001