VBS/Onthefly is an encrypted Visual Basic Script worm which
spreads (mass mails) itself using Microsoft Outlook application.
On February 12th, 2001 this worm has spread rapidly in all over
the world in just a few hours.
Update on 14th of February, 2001: The outbreak caused by this
virus seems to be quieting down now. It seems that the virus
caused biggest infection in North America on the 12th of
February. This seemed to caused largely because of timezone
issues; at this time it was late evening or night time in Europe
and Asia. When people in Europe woke up on the 13th, most
antivirus programs already handled the virus and the media was
warning users from not touching Kournikova-themed attachments.
F-Secure estimates that Onthefly-virus infected several hundreds
of thousands of computers worldwide, putting this virus into the
same category with Melissa virus in 1999 - which was the largest
virus case of its time. However, Onthefly was significantly
smaller than LoveLetter. Additionally, Onthefly did not do any
direct damage.
The author of the virus ("OnTheFly") has been found. His
real-world identity has been found as well and passed on the the
officials for further investigation.
VBSWG.J worm arrives as an attachment in Outlook message with the
following content:
Subject: Here you have, ;o)
Body: Hi:
Check This!
Attachment: AnnaKournikova.jpg.vbs
Once a user click on the attached file the worm execues. First it
adds the following key to the registry:
HKEY_CURRENT_USER\Software\OnTheFly = "Worm made with Vbswg 1.50b"
The worm then copies itself to Windows directory using a constant
file name "AnnaKournikova.jpg.vbs" and sends itself to all
recipients on all address books. It also adds a marker to the
registry, so it will not mass mail again.
At January 26th the worm will open the web browser and connect to
an innocent Netherlandic web site.
F-Secure Anti-Virus has a generic detection that detects this
worm before it started to spread globally. This detection is
included in updates released since the beginning of February,
2001.
To be sure that your F-Secure Anti-Virus is up to date, please
download and install the latest updates from here:
![](/images/pixel.gif"){kind=tracking}
