The following is an archived copy of a message sent to a Discussion List run by the Campaign Against Sanctions on Iraq.

Views expressed in this archived message are those of the author, not of the Campaign Against Sanctions on Iraq.

[Main archive index/search] [List information] [Campaign Against Sanctions on Iraq Homepage]


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

IMPORTANT VIRUS ALERT




The two messages to this list this morning from Dave Rolstone included the 
JS/KAK worm (a type of virus). I would advise users of Outlook Express not
to read the messages. I will post clean versions of the message to the
list archive in due course.

Incidentally, for this and other reasons, sending of plain text emails
rather than those which include HTML formatting is preferable. Outlook
Express users can choose this option in their Preferences/Options.

For more info about the virus, see for example
http://vil.nai.com/vil/wsh10509.asp
http://www.pspl.com/virus_info/worms/kak.htm
http://www.commandcom.com/virus/kak.html.

There is an upgrade available from Microsoft to close the security hole
used by this virus (but you'll still need to disinfect if you're
infected).

Further information about the worm from the Web:

JS/KAK is a java script based worm. This worm affects Windows 95 and
Windows 98. This worm uses the known security hole of Outlook Express to
infect and spread. When the script is executed, it modifies Outlook
Express signature feature, which enables worm to attach all out going
messages. When the recipient receives an infected email, it creates a file
called KAK.HTA under Windows\Startup directory. At the time of next reboot
system will be infected with this worm.

The worm triggers 1st of every month after 17:00
Hours (5:00 PM) and shutdown windows, after displaying the following
message:

          Kagou-Anit-Kro$oft say not today! 

This JS/KAK worm first appeared in December 1999.

This worm is also known as Kagou-Anti-Krosoft or VBS.Kak.Worm.


-- 
-----------------------------------------------------------------------
This is a discussion list run by the Campaign Against Sanctions on Iraq
For removal from list, email soc-casi-discuss-request@lists.cam.ac.uk
Full details of CASI's various lists can be found on the CASI website:
http://welcome.to/casi


[Campaign Against Sanctions on Iraq Homepage]