The Data security company Norman ASA warns against a new email worm currently known as VBS/VBSWG.S@mm.Worm with an attachment called AnnaKournikova.jpg.vbs.

This is a new email worm reported from numerous sites in Europe and the US. It is an encrypted VB Script created by a virus creation utility called VBSWG. The worm contains the text "Vbs.OnTheFly Created By OnTheFly"

The worm spreads as an attachment called AnnaKournikova.jpg.vbs, pretending to be an image of the well-known tennis player. If the user clicks on the attachment, the worm will copy itself to the Windows directory and also send itself to all addresses in all address books in Outlook.

Every Jan. 26th the worm will open a browser window to a known online shop in the Netherlands.

Subject: "Here you have, ;o)" Body: "Hi: Check This!"

Attachment name : AnnaKournikova.jpg.vbs.

The worm will normally only massmail itself once, as it sets a registry key to determine if the mailing routine has already been executed.

Removal of the worm

Norman Virus Control with definitionsfiles from february 12 can detect and remove this worm. Users are encouraged to update their Norman Virus Control protection to the most recent version.

More information on www.norman.com

For further information, please contact:

Snorre Fagerland Virus Analyst tel +47-93-00-53-07 Norman ASA, Bjørn Windfeldt, tel: +47-67-10-97-76, mobile: +47-92-40-06-92