February 12, 2001
It seems everyone wants to see pictures of the famed tennis star, Anna Kournikova. In February 2001, a mass-mailing virus masquerading as a picture of the international tennis star began spreading rapidly around the Internet. Within a few hours of discovery, it had already infected thousands of computers in both the U.S. and the U.K.
The email carrying the virus arrives with the subject line: "Here you have, ;o)". The message body reads "Hi: Check this!" and the infected attachment is named "AnnaKournikova.jpg.vbs". Due to the nature of such email-borne viruses, the email will be received from someone you know. Other variants may follow, with different subject lines, message bodies, or attachment names. As often occurs, the virus name differs among vendors. Following are the most common aliases: "Anna Kournikova", "Onthefly", "SST", "I-Worm.Lee.o", "VBS/SST, "VBS/Anna", "VBS/Kalamar", "VBS/VBSWG.J", and "VBS_Kalamar.a".
According to Alex Shipp, Senior anti-virus technologist for MessageLabs, a managed service provider in the UK, "the virus initially reached critical mass twice as quickly as LoveBug". Indeed, MessageLabs indicates that nearly 20,000 copies of the virus infected emails had been intercepted within a 24-hour period. MessageLabs' VirusEye watch of the threat includes comprehensive comparative graphs, depicting historical data on Loveletter and current spread ratios of the Anna Kournikova virus.
The email worm performs a one-time mass-mailing of itself to addresses listed in the infected user's address book and on January 26th, opens a seemingly benign web page located in the Netherlands. Requiring Windows Scripting Host to infect, the virus affects only Microsoft Windows users.
