Sorry - Redirected...
Gatot Purnomo
----- Original Message -----
From: GPURNOMO <[EMAIL PROTECTED]>
To: Bill Thoen <[EMAIL PROTECTED]>
Sent: Tuesday, July 18, 2000 10:26 PM
Subject: Re: MI WARNING: Virus Alert for MapInfo-L - IT'S REAL!
> Hi All,
>
> I did experience this annoyance. And I had just survived from this issue
> last week.
>
> Please find some statements I got from several sites that might overcome
the
> worm.
> I have updated my Outlook Express 5.0 with this patch - and works
properly.
> This is considering that I am subscribing some mailing-list which allow
text
> and html format, opening the possibility to be infected.
>
> Regards,
> Gatot Purnomo
>
>
> This KAK worm utilises a security hole in internet explorer. This hole
> has been plugged with a patch available from Microsoft. This patch is
> available from
> http://support.microsoft.com/support/kb/articles/Q240/3/08.ASP
>
> *** If you find out that your computer is infected, i.e. if you go through
> START button > Program > StartUp and find kak there, then I guess you must
> remove the infection. Follow the step below: ***
>
> To remove an infection of kak..
>
> Delete the following files..
> c:\windows\kak.htm
> c:\windows\system\(name).hta
> *In the entry, "(name)" is a random 8 character name (e.g. 98278AE0.HTA).
>
> c:\windows\Menu D�marrer\Programmes\D�marrage\kak.hta
> *** I don't seem to have the Menu Demarrer bit above in my computer ***
>
> c:\windows\Start Menu\Programs\StartUp\kak.hta
>
> Edit the c:\AUTOEXEC.BAT and remove the line which runs the file KAK.HTA
> and then delete it from its folder location.
>
> The system registry is also modified when the script executes a shell
> registry update using regedit and the REG file written to the local
> system.
> You need to remove the registry modification by deleting the following
> key..
>
> *** From START button, run Regedit ***
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> cAg0u = "C:\WINDOWS\SYSTEM\(name).hta"
>
> Here again, the entry "(name)" is a random 8 character name (e.g.
> 98278AE0.HTA).
> *** HKLM stands for HKEY_LOCAL_MACHINE ***
> *** Press the + next to HKEY_LOCAL_MACHINE, and + next to SOFTWARE, etc.
> until you are in Run ***
> *** In the right hand window, you would then see the "cAgOu..." line ***
> *** Select the "cAgOu..." line and press Delete button on your keyboard
>
> I hope it's quite clear.
>
> ---end of kak worm solution
> ===================
>
>
> ----- Original Message -----
> From: Bill Thoen <[EMAIL PROTECTED]>
> To: Bill Thoen <[EMAIL PROTECTED]>
> Cc: <[EMAIL PROTECTED]>
> Sent: Monday, July 17, 2000 9:09 PM
> Subject: Re: MI WARNING: Virus Alert for MapInfo-L - IT'S REAL!
>
>
> > Yep... this one is real. Steer clear of the message with the
> > subject:
> >
> > MI Re: Gradient/slope shading
> >
> > Note that this is a response to an original that didn't have the
> > virus. I just received the actual message and went into my
> > Netscape mail folder with a text editor before opening the
> > message (you can't do that if you use Internet Explorer because
> > it packs messages as binary files... and guess what sort of
> > browsers this virus attacks?) Sure enough, there it was embedded
> > in between <<SCRIPT tags. Snipped it out and then no problems.
> > Interesting techinique...simple too. As long as people insist on
> > using HTML formatted mail, we will see lots more of these. BTW,
> > it's unlikely that Roeland had any idea this had attached itself
> > to his mail, so let's not flame the wrong party.
> >
> > Makes me wonder if things like this would convice people to send
> > only plain text messages and refrain from using attachments
> > (including vcards!). I really don't think we need HTML text in a
> > mailing list.
> >
> > - Bill Thoen
> > ------------------------------------------------------------
> > GISnet, 1401 Walnut St., Suite C, Boulder, CO 80302
> > tel: 303-786-9961, fax: 303-443-4856
> > mailto:[EMAIL PROTECTED], http://www.ctmap.com/gisnet
> > ------------------------------------------------------------
> >
> > Bill Thoen wrote:
> > >
> > > This message has triggered multiple virus alerts by servers
> > > worldwide handling mail to MapInfo-L:
> > >
> > > Date: Mon, 17 Jul 2000 12:26:55 +0200
> > > From: Roeland van der Spek <[EMAIL PROTECTED]>
> > > To: Mapinfolist <[EMAIL PROTECTED]>
> > > Subject: MI Re: Gradient/slope shading
> > >
> > > Apparently the KAKWORM.A virus is in the attachment. I'll be checking
> > > into this, but just in case it's real and not some misidentified
> MapBasic
> > > code, this warning is a word to the wise.
> > >
> > ----------------------------------------------------------------------
> > To unsubscribe from this list, send e-mail to [EMAIL PROTECTED] and put
> > "unsubscribe MAPINFO-L" in the message body, or contact [EMAIL PROTECTED]
> >
>
----------------------------------------------------------------------
To unsubscribe from this list, send e-mail to [EMAIL PROTECTED] and put
"unsubscribe MAPINFO-L" in the message body, or contact [EMAIL PROTECTED]
