Q-C Online support pages
Technical support article

About the VBS.Onthefly (Anna Kournikova)



The "VBS/OnTheFly" malicious code is a VBScript program that spreads via email. This malicious code can infect a system if the enclosed email attachment is run. Users who receive copies of the code via electronic mail will probably recognize the sender. We encourage users to avoid executing code, including VBScripts, received through electronic mail, regardless of the sender's name, without prior knowledge of the origin of the code or a valid digital signature.

It is possible for the recipients to be be tricked into opening this malicious attachment since file will appear without the .VBS extension if "Hide file extensions for known file types" is turned on in Windows.

Also known as VBS/SST, the virus initially poses as an attachment--AnnaKournikova.jpg.vbs--included in a message with one of three similar subject lines: "Here you are ;-)," "here you have ;o)" and "here you go ;-)."

The virus uses the Visual Basic scripting language to infect Windows systems and then, on systems using Microsoft's Outlook e-mail program, mails itself out to the entire address book. The ability to mail itself out to a large number of Internet users classifies the virus as a worm. When run the worm creates the registry key: HKEY_CURRENT_USER\Software\OnTheFly . If the day is January 26, the worm attempts to direct your Web browser to an Internet address in The Netherlands. Next, it checks to see if the mass-mailing routine has been executed. If not, the worm E-mails everyone in your Microsoft Outlook address book and creates the registry key: HKEY_CURRENT_USER\Software\OnTheFly\mailed . This prevents the mail routine from running again. The worm then remains running, and if it is deleted, it attempts to recreate itself. Due to a bug in the code, the worm instead recreates itself as a zero-byte file.

To remove the virus, consult your anti-virus software manual about updating virus definitions and then have it scan your machine. If you are unsure how to do this, contact the provider of your anti-virus software.

For more information on virus updates and anti-virus software, visit our Virus Information section.

Local events heading








  Today is Friday, May 24, the 144th day of 2013. There are 221 days left in the year.
1863 -- 150 years ago: A military escort will be at the square at 9 a.m. tomorrow forthe funeral of Lieut. Joseph Eaton. The county judge is absent in Chicago, which willaccount for his not being in the procession.
1888 -- 125 years ago: Rock Island's City Council last night appropriated $95,000 forexpenses for the 1888 and 1889 fiscal year.
1913 -- 100 years ago: Mrs. F.W. Reimers last night was re-elected president of the RockIsland Musical Club at a meeting in the New Harper Hotel.
1938 -- 75 years ago: Seven members of Boy Scout Troop 21 got their Eagle badges lastnight. They were Ralph Hurt, Robert Nelson, Howard Schersten, Cecil Nelson, RobertFryxell, Clarence Stone and Rollin Hurt.
1963 -- 50 years ago: Mayor Morris Muhleman has resorted to a form letter in an effort toanswer objections to the wheel tax increase. "It was my hope that I could, in some way,restore the faith of the citizens in our city. In order to do this I knew I must face the factthat I would become very unpopular."All they are trying to do is protect the citizensproperty and build their town.
1988 -- 25 years ago: RICCA, the Rock Island County Council on Addictions, inconjunction with the Quad City Downs, will hold its annual "Night at the Races" June 2.The benefit "Night at the Races" will raise funds locally to assist in maintaining the twohalfway houses, New Hope Lodge (for women) and Beacon House (for men).




(More History)