Category: Viruses and SpywareProtection available since:12 Feb 2001 00:00:00 (GMT)
Type: Visual Basic Script wormLast Updated:15 May 2012 06:42:53 (GMT)
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

VBS/SST-A is an email-aware Visual Basic Script worm.

The worm arrives in an email with the following characteristics:

Subject line: Here you have, ;O)
Message text: Hi:Check This!
File attachment: AnnaKournikova.jpg.vbs

Screenshot of inbox with AnnaKournikova.jpg.vbs attachment

The virus lures users into activating it by pretending to be a jpeg graphic of Russian tennis player Anna Kournikova.

The first time the attached file is executed it will write a copy of itself to the user's Windows directory. The worm will then attempt to send a copy of itself to every entry in the user's Outlook address book.

The worm makes changes to the Registry, creating an entry called HKCU\software\OnTheFly.

On the 26th of January the worm attempts to connect to a website in the Netherlands, www.dynabyte.nl