Virus!!! Don't open: Re:Here you have,:o] Virus!!!
raindance at BIGFOOT.COM
Mon Feb 12 22:56:10 EST 2001
Don't open any email with this subject line it is a virus:
Re:Here you have,:o]
Here is the reason not to open it. The reason is copied below.
We have been quarantining this virus all morning. NAI has put this
HIGH RISK. If you receive it, DO NOT OPEN IT, DELETE IT. If you have
question please call the Helpdesk at 713-308-9355.
Virus Name Risk Assessment
VBS/SST at MM High
Discovery Date: 08/14/2000
Minimum Dat: 4092
Minimum Engine: 4.0.35
DAT Release Date: 08/23/2000
Description Added: 02/12/2001
AVERT first discovered this threat in August of 2000. The 4092 DATs are
required for detection. Users should update to current engine and DATs
ensure maximum protection.
Note: Ensure that the extensions .VBS is included when scanning. This is
default setting with product version 4.5 and later.
This script was created by a worm generating tool. As such, the
of its actions may vary. The most common variant functions as follows.
When run, the script copies itself to the WINDOWS directory as
"AnnaKournikova.jpg.vbs". It attempts to mail a separate email message,
using MAPI messaging, to all recipients in the Windows Address Book
the following information:
Subject: Here you have, ;o)
It also creates a registry key and key values. The script refers to
values to check if the mailing routine has already taken place:
HKEY_USERS\.DEFAULT\Software\OnTheFly\mailed=(1 for yes)
On January 26th, the script attempts to connect to the web site
- Presence of the file "c:\WINDOWS\AnnaKournikova.jpg.vbs"
- Presence of the registry key: HKEY_USERS\.DEFAULT\Software\OnTheFly
- Users complaining that you've sent them a virus.
Method Of Infection
This script arrives as an email attachment which. Opening this
infects your machine. Once infected, the script attempts to mail itself
all recipients found in the Windows Address Book.
Use specified engine and DAT files for detection and removal. Delete any
file which contains this detection.
Name Type Sub Type Differences
no known variants
dhorn at midf.com <mailto:dhorn at midf.com>
More information about the Boatanchors