VBS/SST Worm(aka Vbs.OnTheFly)

The worm is coded in Visual Basic Script language and is spreading via an e-mail message (attachment) with the following Subject::

Here you have, ;o)

The e-mail body contains brief text message that reads:

Hi: Check This!

The body of the worm is hidden in the e-mail attachment (file) named after a well-known Russian tennis player (Anna Kournikova): AnnaKournikova.jpg.vbs. Obviously, the first extension (jpg) is deceiving. The body of the worm starts with a string: Vbs.OnTheFly Created By OnTheFly and another string: Vbswg 1.50b appears at the end of file.

Changes in the registers caused by the worm: Creates HKEY_CURRENT_USER\SOFTWARE\ONTHEFLY\ key and puts the following text into it: Worm made with Vbswg 1.50b. Another key is created (HKEY_CURRENT_USER\SOFTWARE\ONTHEFLY\MAILED) and used to keep track of e-mail activities of the worm. If the value of the key is different from 1, e-mail is sent (with the worm body) to all address in the address book. Finally, the worm would run a browser on January 26 and uses the following address: www.dynabyte.nl to access the chain of computer stores in the Netherland.

Otherwise, there is no destructive activity performed by this worm.