The new Anna Kournikova email worm appears to be mutating as it spreads around the world, with several different subject lines reported for the emails through which it propogates.
The worm is a VBS/SST virus written in Visual Basic Script, that masquerades as a picture of tennis star Anna Kournikova. First reports from Europe were of a an email with the subject line "Here you have, ;o)" and an attachment called AnnaKournikova.jpg.vbs but other subject lines, including 'Check this' have been reported by local users.
Among local busineses to have been infected today are the internet marketing firm Brave New World, recruitment agency Lacey Lee, online job advertising company Adcorp and It distributor Asnet.
The worm, likely to have originated in the Netherlands, only infects PCs running Microsoft Windows and can only propagate on machines running Outlook that have not installed the patch issued by Microsoft after the similarly-designed Love Bug virus swept around the world last year. Like the Love Bug, it mails itself to everyone in an Outlook user's address book.
It also launches and directs web browsers to the address http://www.dynabyte.nl when its payload is triggered in January 26.
Next, the virus checks to see if the mass-mailing routine has been executed.
If not, the worm emails everyone in the Outlook address book and creates the
registry key HKCU/Software/OnTheFly/mailed so that it does not every address
again. The worm then remains running and if it is deleted attempts to recreate
itself. Due to a bug in the code, the virus instead recreates itself as a
Symantec New Zealand spokesman Thom Bailey says the company will have virus definitions allowing the worm to be detected and repaired available for download from http://www.symantec.com/avcenter/download.html by 1.30pm NZ time today.