Anna Kournikova nuisance virus hits local corporates

A virus disguising itself as an image of Russian tennis star Anna Kournikova hit corporate Australia at 8:00am Tuesday, clogging the email systems of at least seven large corporations, according to one security vendor.

The companies range from mid to large size organisations from local and federal government and the IT and PR sectors, said Trend Micro marketing manager Andy Liao.

Laio said the productivity levels of "hundreds of thousands" of users across those organisations had been affected, however Trend Micro was not at liberty to name the companies due to confidentiality agreements with customers.

The virus, known as Anna Kournikova or VBS_Kalamar.A, is a mass-mailer which uses Microsoft Outlook or Outlook Express to email itself as an attachment.

Trend Micro said it was spreading more rapidly than last year's infamous I Love You virus which affected an estimated 15 million PCs worldwide.

According to Liao, multinational companies with access to global email networks are most vulnerable to the virus.

VBS_Kalamar.A was first reported in the US at 11:00pm E.S.T last night, effecting the email system of one large North American organisation, and 10 companies in Europe, Liao said.

However, he said business need not be alarmed over the virus, as it could be easily blocked at the email firewall. "This is the most basic kind of virus. The only danger here is that it tricks people into running the attachment, exactly like I Love You, and it will spread via Outlook only."

Instead, he said IT managers should take control of end-users by installing protection at the email server. "But protection's only a tool - it's only as good as the IT administrator, and people often don't learn from past mistakes," he added.

Depending on the industry, blocking all email attachments or scanning and cleaning email systems promptly would ensure productivity levels wouldn't nose-dive, Liao advised.

Computer Associates International (CA) also received reports of the virus' existence in the Asia Pacific, said Ian Hameroff, a CA business manager, who called the threat a "worm" rather than a virus.

The virus, as all but CA have termed the threat, features one of three variants of the subject line "Here you go :-)" as well as three variants of the name for the attachment, based around "Anna.Kournikova.jpg.vbs." The image is intended to appear to be a .JPG image of Anna Kournikova. The e-mail resends itself, but does not appear to do any damage like deleting files or corrupting data.

"Damage is a variable term," CA's Hameroff said. "This does cause damage in ways such as inappropriate bandwidth use or by filling up an e-mail server."

The virus appears to be doing both ably.

CA hasn't been able to nail down the origin, Hameroff said. The worm, or virus depending on the source, tries to launch a browser on Jan. 26 of any year that links to a domain name in the Netherlands, he said, adding that doesn't necessarily mean that is the country of origin.

CA came to the conclusion that the virus is "very simplistic" and appears to be a sample piece of work shared among "black hat sites" of hackers and miscreants.

Trend Micro says the virus should come as no surprise to businesses given that it hit the day before a universal event like Valentines Day. "Virus-writers try to target certain days and it's more likely that viruses will hit on significant days. I Love You was about two days before Mother's Day."

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

More about CA TechnologiesMicrosoftTrend Micro Australia

Show Comments