| This is a Visual Basic Script virus similar to the ILOVEYOU Virus that circled the globe in 2000. It mass mails the virus as an attachment called ANNAKOURNIKOVA.JPG.VBS via Microsoft Outlook. If the current system date is January 26th, this virus tries to connect to a computer shop web site in the Netherlands. The virus can also be found on a UseNet newsgroup, microsoft.publick.opk.windows9x. The script attempts to mail itself to all recipients found in the Windows Address Book. |
This virus was first
discovered in August 2000, but made a comeback in February 2001 as
well. The virus is sent using the following email:
Subject: Here you have, :0)
Body:
Hi:
Check This!
Attachment: AnnaKournikova.jpg.vbs
Changes the Virus Makes to the Windows Registry
The virus creates the
following changes to the Windows Registry that should be deleted
HKEY_USERS\.DEFAULT\Software\OnTheFly
HKEY_USERS\.DEFAULT\Software\OnTheFly\mailed=(1 for yes)
The virus will also leave the file AnnaKournikova.jpg.vbs in the
c:\windows directory
How to Clean the Virus
Other than deleting the file and registry entries shown above, this virus should be deleted by running an up-to-date virus checking program, such as the ones shown at the bottom of this page. Alternatively, you can click on the link below for a free on-line virus scanner.
Tools for Removing Spyware, Adware, and Malware
PC HELL
Other Pages
Welchia (Dllhost.exe and SVCHost.exe) Worm Removal
Uninstall Antivir Instructions
How to Manually Run the Microsoft Malicious Software Removal Tool
Bloodhound.Exploit.6 Virus Removal
Backdoor SDBot.H Trojan Removal
