February 12, 2001, revised
There's a new virus spamming the world. Anna (a.k.a., VBS/SST, Kalamar, OnTheFly) has some of the same characteristics as the ILOVEYOU worm. Anti-virus software companies are still investigating this new worm. Anna is known to be a mass mailer; the number of infections worldwide has risen every hour. Anna uses listings found in the Microsoft Outlook address book to send copies of itself. The real danger from Anna is that it will overload e-mail servers with excess traffic. Anna currently ranks as a 7 on the ZDNet Virus Meter.
How It Works
The Anna virus arrives via e-mail with the following information:
Subject: Here you have, ;o)
Body: Hi: Check This!
Attachment: AnnaKournikova.jpg.vbs
Clicking on the attachment activates the worm. Once activated, Anna uses the Microsoft Outlook address book to mass e-mail itself to others. Anna then changes the Registry to include the following entry:
HKCU\software\OnTheFly
Also, Anna schedules itself to connect to a Dutch computer shopping Web site, www.dynabyte.nl, every January 26th.
