|
If I may add,
As prevention, IE 5.0 users should go to the Microsoft
Software Updates page (from your browser, Tools => Windows Update) and get
the required security patch. There you will see detailed information
on the patches needed according to your IE version (IE 5.5 is also
available).
If you have the patch, the macro will not run.
Regards,
----- Original Message -----
Sent: Friday, 21 July, 2000 02:22
PM
Subject: MI How to get the KAKWORM virus
off your machines
DO YOU USE INTERNET EXPLORER 5.0? PLEASE READ
THIS:
There are now at least two people on MapInfo-L who have
been
covered in 'KAK'. This was posted here last week, but obviously
is
worth reposting:
"...the VBS/Kakworm virus.
This is an e-mail worm
virus that is activated by pre-viewing the
message in
combination with
Microsoft Internet Explorer v5.0.
The following extract is from a
virus removal utility and
describes the
virus:
Memory-resident:
In macro environment
This is an email worm. It only infects users with
Microsoft
Internet
Explorer V5.0. If the user opens or previews an
infected email
message the
worm drops KAK.HTA program into Windows
startup folder so that it
runs on
starting Windows.
The KAK.HTA
file creates C:\WINDOWS\KAK.HTM hidden file and
changes the
Microsoft
Outlook Express registry settings so that the KAK.HTM
is
automatically
included in every outgoing message as a signature
file.
KAK.HTA also
changes the Windows registry
key
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\cAg0u so that
it
includes
the name of the worm file. On the 1st of any month the
worm
displays the
messagebox "Kagou-Anti_Kro$oft says not today" and
runs Windows
shutdown.
First reported in January
2000.
Recovery:
To disinfect infected objects delete all macros
belonging to the
virus."
--
- Bill
Thoen
------------------------------------------------------------
GISnet,
1401 Walnut St., Suite C, Boulder, CO 80302
tel: 303-786-9961, fax:
303-443-4856
mailto:[EMAIL PROTECTED],
http://www.ctmap.com/gisnet
------------------------------------------------------------
----------------------------------------------------------------------
To
unsubscribe from this list, send e-mail to [EMAIL PROTECTED] and put
"unsubscribe
MAPINFO-L" in the message body, or contact [EMAIL PROTECTED]
|
