[COMP] Worms

http://www.techweb.com/wire/story/TWB20000330S0016
Vendor Reports New Worm Viruses
(03/30/00, 5:03 p.m. ET) By Mo Krochmal, TechWeb 
Two new software programs circulating on the Internet could damage computer 
files, a software vendor said Thursday. 

F-Secure, San Jose, Calif., formerly known as Data Fellows, said Thursday 
that two worms are spreading rapidly in Windows-based computer networks. They 
are similar to the infamous Melissa virus. According to a the company, both 
programs spread via users of the Microsoft Outlook e-mail program -- but in 
two different ways. Irok propagates through a file attachment called 
IROK.EXE, while the Kak worm arrives within an e-mail message. 

"We are aware of Irok and Kak and have had a few reports of Kak, but nothing 
significant yet," said a spokesman from CERT, a nonprofit organization at 
Carnegie Mellon University that tracks computer viruses. 

Last year, the Melissa virus spread rapidly, clogging networks and, in some 
cases, destroying data. The writer of that virus plead guilty to a charge of 
computer theft and faces a minimum five-year prison term. 

Viruses are one of the biggest security problems in information technology. 
According to a survey conducted by the accounting firm PriceWaterhouseCoopers 
last summer, about 64 percent of companies worldwide were hit by at least one 
virus in the previous 12 months, up from 53 percent the year before. In the 
United States, viruses hit 69 percent of companies. 

The vendor on Thursday said the Kak worm is written in Javascript and works 
under English and French language versions of the Windows 95/98 operating 
system only and works only with Outlook Express 5.0. It executes 
automatically when e-mail is viewed and replaces the standard e-mail 
signature of the user with an HTML file. The worm activates on the first day 
of each month if the machine is restarted after 5 p.m. It displays a message 
and then shuts down Windows. 

Users can stop the virus by disabling "Active Scripting" in the preferences 
file. 

The Irok worm spreads through an executable file that affects systems running 
Windows 95, 98, NT, and 2000. It replicates further if Outlook mail is 
available. 

When started, the program modifies a system so that the next time the machine 
is started, the worm sends an e-mail message to 50 e-mail addresses found in 
Outlook address books. The message has the subject line of "I thought you 
might like to see this" and has a text message saying "I thought you might 
like this. I got it from paramount pictures. It's a startrek [sic] screen 
saver," the vendor said. 

The virus tries to propagate through chat clients and will try to overwrite 
files on the hard drive.    

========================================
Avenir Web's Computers Mailing List

List Modes, Subscription, and General Info:
Go to http://avenir.dhs.org/mailing.html
List Archives: http://avenir.dhs.org/archives/
Administrative Contact: weez@xxxxxxxxxxxxxx

Get computer help: http://avenir.dhs.org
========================================

Other related posts: