DO YOU USE INTERNET EXPLORER 5.0? PLEASE READ THIS:
There are now at least two people on MapInfo-L who have been
covered in 'KAK'. This was posted here last week, but obviously
is worth reposting:
"...the VBS/Kakworm virus.
This is an e-mail worm virus that is activated by pre-viewing the
message in
combination with Microsoft Internet Explorer v5.0.
The following extract is from a virus removal utility and
describes the
virus:
Memory-resident: In macro environment
This is an email worm. It only infects users with Microsoft
Internet
Explorer V5.0. If the user opens or previews an infected email
message the
worm drops KAK.HTA program into Windows startup folder so that it
runs on
starting Windows.
The KAK.HTA file creates C:\WINDOWS\KAK.HTM hidden file and
changes the
Microsoft Outlook Express registry settings so that the KAK.HTM
is
automatically included in every outgoing message as a signature
file.
KAK.HTA also changes the Windows registry key
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\cAg0u so that
it includes
the name of the worm file. On the 1st of any month the worm
displays the
messagebox "Kagou-Anti_Kro$oft says not today" and runs Windows
shutdown.
First reported in January 2000.
Recovery:
To disinfect infected objects delete all macros belonging to the
virus."
--
- Bill Thoen
------------------------------------------------------------
GISnet, 1401 Walnut St., Suite C, Boulder, CO 80302
tel: 303-786-9961, fax: 303-443-4856
mailto:[EMAIL PROTECTED], http://www.ctmap.com/gisnet
------------------------------------------------------------
----------------------------------------------------------------------
To unsubscribe from this list, send e-mail to [EMAIL PROTECTED] and put
"unsubscribe MAPINFO-L" in the message body, or contact [EMAIL PROTECTED]
