> > Morning Everyone, > > > > This is not the day to be opening Anna Kornikova attachments - this has just come from McAfee AVERT. My apologies if this does not interest everybody but beware. > > > > Regards, Gaila Cherry List Admin > > > > > > > Subject: High Risk Virus Outbreak > > > > > > > > The biggest outbreak since the Love Bug - happening today - we've had > > confirmations from at least 50 enterprise customers of infection - for > > example one of the largest telco had over 4500 infected files which were > > caught at the mail server level with McAfee software to prevent the mass > > mailing from bringing down their system. > > > > It's being called Anna Kournikova - as you'll think it's a picture of > > the > > tennis star. If you execute the attachment, it will make an attempt to > > email > > the attachment to everyone in your address book..... > > > > AnnaKournikova.jpg.vbs is the attachment. The email is "Here you have, > > ;o) > > Has affected several large companies; One of the top 5 telco's; one of > > the > > Top European ISPs, Top Government Agency, etc. > > > > Attached below is the information from Vinny - regarding the specifics. > > Mcafee-at-home is being updated with pertinent information, the banner > > will > > be updated to reflect the high risk virus warning and a link to purchase > > VirusScan from the estore. > > > > > > Here's the text at the below link in case you're not able to get to > > AVERT: > > > > > > AVERT first discovered this threat in August of 2000. The 4092 DATs are > > required for detection. Users should update to current engine and DATs > > to > > ensure maximum protection. > > Note: Ensure that the extensions .VBS is included when scanning. This is > > a > > default setting with product version 4.5 and later. > > > > This script was created by a worm generating tool. As such, the > > particulars > > of its actions may vary. The most common variant functions as follows. > > > > When run, the script copies itself to, > > "c:\WINDOWS\AnnaKournikova.jpg.vbs". > > It attempts to mail a separate email message, using MAPI messaging, to > > all > > recipients in the Windows Address Book using the following information: > > > > Subject: Here you have, ;o) > > Body: > > Hi: > > Check This! > > > > Attachment: AnnaKournikova.jpg.vbs > > > > It also creates a registry key and key values. The script refers to > > these > > values to check if the mailing routine has already taken place: > > > > HKEY_USERS\.DEFAULT\Software\OnTheFly > > HKEY_USERS\.DEFAULT\Software\OnTheFly\mailed=(1 for yes) > > > > > > > > Currently AVERT is responding to customer inquiries and samples > > submitted on > > a virus we call VBS/SST. We have seen over 100 samples in less than 2 > > hours. > > > > It is also known as the Anna Kournikova virus, as the attachment is > > supposed > > to be a jpg file of her. She is a tennis player if you are wondering. > > :-) > > > > We are protected internally (as we have most everything updated to the > > files > > needed), but as always you should not launch/double click anything that > > is > > an attachment, especially one that you see like this. Simply delete the > > message and purge it from you deleted folders box as well. > > > > For more information you can go to > > http://vil.nai.com/vil/virusSummary.asp?virus_k=99011 > > <http://vil.nai.com/vil/virusSummary.asp?virus_k=99011> > > > > We have begun our emergency outbreak procedures though in a most > > unconventional way, and I apologize for this as we have been focused on > > two > > other viruses for most of the past twelve hours. I know ww have missed > > some > > of the process, but this one as usual is weird. > > > > These may hit on Valentines day. We'll keep you posted on those, but if > > you > > want to read about them you can go here. > > > > http://vil.nai.com/vil/virusSummary.asp?virus_k=99009 > > <http://vil.nai.com/vil/virusSummary.asp?virus_k=99009> > > > > http://vil.nai.com/vil/virusSummary.asp?virus_k=99010 > > <http://vil.nai.com/vil/virusSummary.asp?virus_k=99010> > > > > > > >