In a message dated 4/2/00 10:42:00 AM Eastern Daylight Time, [log in to unmask]
writes:

> Subject: MEDIA RELEASE:F-SECURE WARNS OF TWO NEW WIDESPREAD WORMS
>
>
> > This press release comes from F-Secure. For more
> > information on F-Secure's mailing list policy,
> > see end of message.
> >
> > Press release
> >
> > F-SECURE CORPORATION WARNS OF TWO NEW WIDESPREAD COMPUTER WORMS
> >
> > Irok and Kak worms spreading globally
> >
> >
> > Espoo, Finland, March 30, 2000 - F-Secure Corporation, a leading provider
> > of centrally-managed, widely distributed security solutions, is warning
> > computer users about two new e-mail worms that are currently spreading
> > rapidly in several locations around the world. The Irok and Kak worms
both
> > spread via e-mail as electronic chain letters, much like the infamous
> > Melissa virus did exactly one year ago. F-Secure Anti-Virus will protect
> > users against these new threats.
> >
> > Technically, the Irok and Kak worms operate in very different ways, but
> > both spread via Microsoft Outlook e-mail and are very widespread right
> now.
> > The biggest difference to the end user is that Irok arrives in an
> > attachment called IROK.EXE while Kak arrives in a normal e-mail which
> > apparently has no attachment at all.
> >
> > Both worms are only a threat to Microsoft Windows users and both worms
> only
> > spread further via the Microsoft Outlook e-mail application.
> >
> > The Irok worm spreads as a 10001-byte sized program called IROK.EXE. It
> > works under Microsoft Windows 95, 98, NT and 2000. It replicates further
> > via e-mail if Microsoft Outlook is available. It does not work with
> Outlook
> > Express.
> >
> > When IROK.EXE is executed, the worm modifies the system so that during
> next
> > time the machine is started, the worm will send an e-mail message to 60
> > e-mail addresses found in Outlook's address books. These addresses can be
> > addresses of individual people or group addresses (such as mailing
lists).
> >
> > The message that the worm spreads itself with looks as follows:
> >
> > From: (name of the infected user)
> > To: (random e-mail address from address book)
> > Subject: I thought you might like to see this.
> >
> > Text: I thought you might like this. I got it from paramount pictures
> > website. It's a startrek screen saver.
> >
> > Attachment: IROK.EXE
> >
> > The virus also tries to locate the mIrc chat client and will attempt to
> > modify it to spread the virus further via chat channels, and it infects
> COM
> > and EXE program files found on the local hard drive.
> >
> > Eventually, the virus will display a long message on the screen and will
> > try to overwrite files on the hard drive.
> >
> > The Kak worm is written in Javascript. It works under English and French
> > versions of Windows 95/98; it does not work under Windows NT or Windows
> > 2000. Kak replicates further via e-mail only if Outlook Express 5.0 is
> > installed - it does not work with normal Microsoft Outlook.
> >
> > The worm uses a known security vulnerability in Outlook Express to
execute
> > automatically when e-mail is viewed. Once the user receives an infected
> > email message, and opens or views the message in the preview pane, the
> worm
> > modifies the system in such a way that the next time the machine is
> > started, the standard e-mail signature of the user is replaced with a
HTML
> > file infected by the virus.
> >
> > As a result, every e-mail message after that will contain the worm and
> will
> > infect the recipient's machine as soon as it is opened in Outlook
Express.
> >
> > The Kak worm activates on the first day of each month if the machine is
> > restarted after 5 pm. At this time the virus will show this message:
> >
> > Kagou-Anit-Kro$oft say not today!
> >
> > After this, the worm will shut down Windows, but no permanent damage is
> done.
> >
> > The Outlook Express security hole exploited by this worm can be closed by
> > disabling "Active Scripting" in Outlook Express Preferences. Microsoft
> > [NASDAQ: MSFT] has also done an update to fix this problem. The update
has
> > been available since August 1999.
> >
> > "It is disturbing to see that virus writers continue to harass innocent
> > bystanders with their creations," says Mikko Hypponen, Manager of
> > Anti-Virus Research at F-Secure Corporation. "The virus writers have
> > absolutely nothing to gain and everything to lose by writing these
things.
> > Obviously they learnt nothing from what happened to the author of
> Melissa."
> >
> > Mr. David L. Smith, the alleged author of the Melissa e-mail worm that
> went
> > around the world year ago (on March 28, 1999), has pleaded guilty to a
> > second-degree charge of computer theft in December 1999 in New Jersey
> > Superior Court. He faces a five to ten year prison term and up to a
> > $150,000 fine.
> >
> > Both Irok and Kak worms can be stopped with up-to-date anti-virus
> software.
> > F-Secure Corporation has added detection of these worms to the latest
> > version of F-Secure Anti-Virus.
> >
> > Free evaluation copies of F-Secure Anti-Virus are available at:
> >
> > http://www.F-Secure.com/gallery/
> >
> > Further technical information and screenshots of the worms are available
> at:
> > http://www.F-Secure.com/virus-info/v-pics/
> >
> > About F-Secure Corporation
> >
> > F-Secure Corporation is a leading developer of centrally managed, widely
> > distributed security solutions. The company offers a full range of
> > award-winning, integrated anti-virus, file encryption and VPN solutions
> for
> > workstations, servers and gateways. F-Secure Corporation products and
> > Framework are uniquely suited for delivery of Security as a ServiceT by
> > enterprise IT departments as well as a wide range of partners including
> > ISPs, outsourcing firms and ASPs. For the end-user, Security as a Service
> > is invisible, automatic, reliable, always-on, and up-to-date. For the
> > administrator, Security as a Service means policy-based management,
> instant
> > alerts, and centralized management of a widely-distributed user base.
> >
> > Founded in 1988, F-Secure Corporation is listed on the Helsinki Stock
> > Exchange (HEX: FSC). The company is headquartered in Espoo, Finland with
> > North American headquarters in San Jose, California, as well as offices
in
> > Canada, Germany, China, France, Japan and the United Kingdom. F-Secure
> > Corporation is supported by a network of VARs and Distributors in over 90
> > countries around the globe.
> >
> > For more information, please contact
> >
> > Finland:
> > F-Secure Corporation
> > Mr. Mikko Hyppönen, Manager, Anti-Virus Research.
> > PL 24
> > FIN-02231 ESPOO
> > Tel +358 9 8599 0513
> > Fax +358 9 8599 0599
> > E-mail: [log in to unmask]
> >
> > USA:
> > F-Secure Inc.
> > Mr. Dan Takata, Manager, Training Division, Professional Services
> > 675 N. First Street, 8th Floor
> > San Jose, CA 95112
> > Tel. +1 408 938 6700,
> > Fax +1 408 938 6701
> > e-mail [log in to unmask]
> >
> > http://www.F-Secure.com/
> >
> >
> > Mailing list policy
> >
> > You have previously expressed interest in our products, or have asked
> > to be included on one of our press release lists by personally giving us
> > your e-mail address for this purpose.Our mailing list are for the
> > exclusive use and the expressed purpose of F-Secure and are not
> > sold or or given to third parties.
> >
> > If you no longer wish to receive our press releases, or your email
address
> > has been added to our lists without your consent, you can unsubscribe at
> > http://www.F-Secure.com/news/subscribe.html
> >
> > If you only wish to receive our press releases concerning viruses,
> > please go to
> > http://www.F-Secure.com/news/subscribe.html
> > and first unsubscribe from
> > [log in to unmask]
> > and then subscribe to
> > [log in to unmask]
> >
> -------------end forwarded message