VBSWG.J

Aliases: VBS.OnTheFly, Onthefly

VBSWG.J worm is written in Visual Basic Script (VBS) and is spread by email with subject:

Here you have, ;o).

In the email body there is the text:

Hi:
Check this!

In the attachment is the file AnnaKournikova.jpg.vbs in which the virus body is contained.  Kournikova is a well known Russian tennis player and the first file extension is a fake.  The worm body starts with the string Vbs.OnTheFly Created By OnTheFly and ends with the string Vbswg 1.50b.
The worm will write the value Worm made with Vbswg 1.50b  to the registry key HKEY_CURRENT_USER\SOFTWARE\ONTHEFLY\.  It uses the item HKEY_CURRENT_USER\SOFTWARE\ONTHEFLY\MAILED to mark the implemented send out of its body.  If there is not the value 1 in it, it will create the aforementioned email and send it to all addresses in the address book.
On January 26th it opens a web browser with the address of a computer shop chain in Holland www.dynabyte.nl.  Apart from this advertising the worm does no destructive activity.  This worm is also known under the name VBS.OnTheFly.

PROTECT YOUR COMPUTER!
ESETs NOD32 antivirus software provides comprehensive, easy-to-use, and affordable protection from todays and tomorrows threats. We put the malware expert inside the software, so you don’t have to become one.

DOWNLOAD ESET NOD32 ANTI VIRUS SOFTWARE