VIRUS INFORMATION

02/12/2001 - This script was created by a worm generating tool. When ran, the script copies itself to the Windows directory  as "AnnaKournikova.jpg.vbs" and attempts to mail separate email messages using MAPI messaging, to all recipients in the Windows Address book.

SYMPTOMS

E-mails all individuals in the Windows Address book.

Infects the registry adding the following two keys

HKEY_USERS\.DEFAULT\Software\OnTheFly
HKEY_USERS\.DEFAULT\Software\OnTheFly\mailed=1 or 0

On January 26th, the script attempts to connect to the web site http://www.dynabyte.nl

HOW TO DETECT VIRUS

The virus is sent through mail with the following:

Subject: Here you have, :o)
Body: 

Hi:
Check This!

Attachment: AnnaKournikova.jpg.vbs

METHOD OF REMOVAL

If you believe you have been infected by this virus or you have the file AnnaKournikova.jpg.vbs file in your Windows directory to remove this virus obtain the latest update or DAT file from the virus protection software you have installed on your computer.