UPDATE 2: Anna Kournikova virus changes subject lines

The new Anna Kournikova email worm appears to be mutating as it spreads around the world, with several different subject lines reported for the emails through which it propogates.

The new Anna Kournikova email worm appears to be mutating as it spreads around the world, with several different subject lines reported for the emails through which it propogates.

The worm is a VBS/SST virus written in Visual Basic Script, that masquerades as a picture of tennis star Anna Kournikova. First reports from Europe were of a an email with the subject line "Here you have, ;o)" and an attachment called AnnaKournikova.jpg.vbs but other subject lines, including 'Check this' have been reported by local users.

Among local busineses to have been infected today are the internet marketing firm Brave New World, recruitment agency Lacey Lee, online job advertising company Adcorp and It distributor Asnet.

The worm, likely to have originated in the Netherlands, only infects PCs running Microsoft Windows and can only propagate on machines running Outlook that have not installed the patch issued by Microsoft after the similarly-designed Love Bug virus swept around the world last year. Like the Love Bug, it mails itself to everyone in an Outlook user's address book.

It also launches and directs web browsers to the address http://www.dynabyte.nl when its payload is triggered in January 26.

Next, the virus checks to see if the mass-mailing routine has been executed.

If not, the worm emails everyone in the Outlook address book and creates the

registry key HKCU/Software/OnTheFly/mailed so that it does not every address

again. The worm then remains running and if it is deleted attempts to recreate

itself. Due to a bug in the code, the virus instead recreates itself as a

zero-byte file.

Symantec New Zealand spokesman Thom Bailey says the company will have virus definitions allowing the worm to be detected and repaired available for download from http://www.symantec.com/avcenter/download.html by 1.30pm NZ time today.

Join the newsletter!

Error: Please check your email address.

More about Adcorp AustraliaMicrosoftSymantec

Show Comments
[]