Sophos

VBS/SST-A

Aliases
  • Kalamar.A
  • Calamar
  • OnTheFly
  • Anna
  • Kournikova
  • VBS/VBSWG.J@MM
Category
Type
What to do

Summary

 
Included in our products from March 2001 (3.43)
Detected by All Sophos products

Action

More Information

VBS/SST-A is an email-aware Visual Basic Script worm.

The worm arrives in an email with the following characteristics:

Subject line: Here you have, ;O)
Message text: Hi:Check This!
File attachment: AnnaKournikova.jpg.vbs

Screenshot of inbox with AnnaKournikova.jpg.vbs attachment

The virus lures users into activating it by pretending to be a jpeg graphic of Russian tennis player Anna Kournikova.

The first time the attached file is executed it will write a copy of itself to the user's Windows directory. The worm will then attempt to send a copy of itself to every entry in the user's Outlook address book.

The worm makes changes to the Registry, creating an entry called HKCU\software\OnTheFly.

On the 26th of January the worm attempts to connect to a website in the Netherlands, www.dynabyte.nl

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer