Kournikova
Originally Spotted 12/2/01

E-Mail Message Received (please note different mails may differ slightly)

Subject line: Here you have, ;0)

Attachment: AnnaKournikova.jpg.vbs

Diagnosis

Also known as Onthefly due to the registry key it creates when infecting the host. When launched the attachment opens a Visual Basic Script that forwards itself, if you are using Outlook, to everyone in your address book. This puts great strain on e-mail servers, causing them to overload and crash. It will also load up your browser and try to connect to an Amsterdam computer stores web site (www.dynabyte.nl) on the 26th January of every year.

Please delete this e-mail if you receive it.

For added protection please turn off Windows Scripting Host. There are known vulnerabilities in Visual Basic Scripting that virus writers can exploit. Click here to see how.

This virus demostrates the amount of care you have to take when receiving and opening e-mail. When you receive the e-mail it will look like something sent by one of your friends with a perfectly harmless jpeg however is a dangerous worm.