New "Anna Kournikova" Worm Spreading Fast

Antivirus vendors issued warnings Monday about a new worm now spreading across the Internet. The new worm, vbs.sst, masquerades as an image of Anna Kournikova, a Russian tennis player. vbs.sst attaches itself as a file (AnnaKournikova.jpg.vbs) to an email message whose subject reads, "Here you have, ;0)". The Visual Basic (VB)-based worm works by taking advantage of a quirk in an email client where filenames containing more than one dot are truncated. For example, affected mail clients show the user a filename of AnnaKournikova.jpg, truncating the .vbs extension.

The worm spreads by sending a copy of itself to everyone listed in the user's address book. In addition, the worm attempts to open a Web connection to a site in the Netherlands when the computer's date is January 26. According to Symantec's report, the person responsible appears to have used a virus creation kit to create the vbs.sst worm (also known as Kalamar.A, LEE-O, and VBS.OnTheFly). Panda Software, McAfee, Symantec, Trend Micro, Central Command, and others antivirus vendors all have signatures available to detect this new worm.