Alias:
Type:Worm 
Size: 
Origin: 
Date:02-13-2001 
Damage:Emailversand  
VDF Version:6.23.00.00 
Danger:Low 
Distribution:Low 

DistributionThe worm sends itself by email, to addresses found in Outlook. The email looks like this:
Subject: Here you have ;o)
Body: Hi: Check This!
Attachment: AnnaKournikova.jpg.vbs

Technical DetailsWhen activated, the worm makes the following registry entry:
HKCU\Software\OnTheFly
with the text
„Worm made with Vbswg1.05b“
This is the worm's signature.

First, the worm copies itself in Windows directory (usually C:\Windows) as: „AnnaKournikova.jpg.vbs“.
After sending the emails, the worm makes a second registry entry:
HKCU\Software\OnTheFly\mailed
with the value "1".

The messages are immediately deleted, after they are sent and do not appear in "Sent Items" folder.

The worm's code has another routine, too: on every January, 26th, it opens the Internet site http://www.dynabyte.nl. This is the site of a Netherlads computer magazine.
Description insérée par Crony Walker le mardi 15 juin 2004

Retour . . . .