In a message dated 4/2/00 10:42:00 AM Eastern Daylight Time, [log in to unmask] 
writes:

> Subject: MEDIA RELEASE:F-SECURE WARNS OF TWO NEW WIDESPREAD WORMS
>  
>  
>  > This press release comes from F-Secure. For more
>  > information on F-Secure's mailing list policy,
>  > see end of message.
>  >
>  > Press release
>  >
>  > F-SECURE CORPORATION WARNS OF TWO NEW WIDESPREAD COMPUTER WORMS
>  >
>  > Irok and Kak worms spreading globally
>  >
>  >
>  > Espoo, Finland, March 30, 2000 - F-Secure Corporation, a leading provider
>  > of centrally-managed, widely distributed security solutions, is warning
>  > computer users about two new e-mail worms that are currently spreading
>  > rapidly in several locations around the world. The Irok and Kak worms 
both
>  > spread via e-mail as electronic chain letters, much like the infamous
>  > Melissa virus did exactly one year ago. F-Secure Anti-Virus will protect
>  > users against these new threats.
>  >
>  > Technically, the Irok and Kak worms operate in very different ways, but
>  > both spread via Microsoft Outlook e-mail and are very widespread right
>  now.
>  > The biggest difference to the end user is that Irok arrives in an
>  > attachment called IROK.EXE while Kak arrives in a normal e-mail which
>  > apparently has no attachment at all.
>  >
>  > Both worms are only a threat to Microsoft Windows users and both worms
>  only
>  > spread further via the Microsoft Outlook e-mail application.
>  >
>  > The Irok worm spreads as a 10001-byte sized program called IROK.EXE. It
>  > works under Microsoft Windows 95, 98, NT and 2000. It replicates further
>  > via e-mail if Microsoft Outlook is available. It does not work with
>  Outlook
>  > Express.
>  >
>  > When IROK.EXE is executed, the worm modifies the system so that during
>  next
>  > time the machine is started, the worm will send an e-mail message to 60
>  > e-mail addresses found in Outlook's address books. These addresses can be
>  > addresses of individual people or group addresses (such as mailing 
lists).
>  >
>  > The message that the worm spreads itself with looks as follows:
>  >
>  >   From: (name of the infected user)
>  >   To: (random e-mail address from address book)
>  >   Subject: I thought you might like to see this.
>  >
>  >   Text: I thought you might like this. I got it from paramount pictures
>  > website. It's a startrek screen saver.
>  >
>  >   Attachment: IROK.EXE
>  >
>  > The virus also tries to locate the mIrc chat client and will attempt to
>  > modify it to spread the virus further via chat channels, and it infects
>  COM
>  > and EXE program files found on the local hard drive.
>  >
>  > Eventually, the virus will display a long message on the screen and will
>  > try to overwrite files on the hard drive.
>  >
>  > The Kak worm is written in Javascript. It works under English and French
>  > versions of Windows 95/98; it does not work under Windows NT or Windows
>  > 2000. Kak replicates further via e-mail only if Outlook Express 5.0 is
>  > installed - it does not work with normal Microsoft Outlook.
>  >
>  > The worm uses a known security vulnerability in Outlook Express to 
execute
>  > automatically when e-mail is viewed. Once the user receives an infected
>  > email message, and opens or views the message in the preview pane, the
>  worm
>  > modifies the system in such a way that the next time the machine is
>  > started, the standard e-mail signature of the user is replaced with a 
HTML
>  > file infected by the virus.
>  >
>  > As a result, every e-mail message after that will contain the worm and
>  will
>  > infect the recipient's machine as soon as it is opened in Outlook 
Express.
>  >
>  > The Kak worm activates on the first day of each month if the machine is
>  > restarted after 5 pm. At this time the virus will show this message:
>  >
>  >     Kagou-Anit-Kro$oft say not today!
>  >
>  > After this, the worm will shut down Windows, but no permanent damage is
>  done.
>  >
>  > The Outlook Express security hole exploited by this worm can be closed by
>  > disabling "Active Scripting" in Outlook Express Preferences. Microsoft
>  > [NASDAQ: MSFT] has also done an update to fix this problem. The update 
has
>  > been available since August 1999.
>  >
>  > "It is disturbing to see that virus writers continue to harass innocent
>  > bystanders with their creations," says Mikko Hypponen, Manager of
>  > Anti-Virus Research at F-Secure Corporation. "The virus writers have
>  > absolutely nothing to gain and everything to lose by writing these 
things.
>  > Obviously they learnt nothing from what happened to the author of
>  Melissa."
>  >
>  > Mr. David L. Smith, the alleged author of the Melissa e-mail worm that
>  went
>  > around the world year ago (on March 28, 1999), has pleaded guilty to a
>  > second-degree charge of computer theft in December 1999 in New Jersey
>  > Superior Court. He faces a five to ten year prison term and up to a
>  > $150,000 fine.
>  >
>  > Both Irok and Kak worms can be stopped with up-to-date anti-virus
>  software.
>  > F-Secure Corporation has added detection of these worms to the latest
>  > version of F-Secure Anti-Virus.
>  >
>  > Free evaluation copies of F-Secure Anti-Virus are available at:
>  >
>  > http://www.F-Secure.com/gallery/
>  >
>  > Further technical information and screenshots of the worms are available
>  at:
>  > http://www.F-Secure.com/virus-info/v-pics/
>  >
>  > About F-Secure Corporation
>  >
>  > F-Secure Corporation  is a leading developer of centrally managed, widely
>  > distributed security solutions. The company offers a full range of
>  > award-winning, integrated anti-virus, file encryption and VPN solutions
>  for
>  > workstations, servers and gateways. F-Secure Corporation  products and
>  > Framework are uniquely suited for delivery of Security as a ServiceT by
>  > enterprise IT departments as well as a wide range of partners including
>  > ISPs, outsourcing firms and ASPs. For the end-user, Security as a Service
>  > is invisible, automatic, reliable, always-on, and up-to-date. For the
>  > administrator, Security as a Service means policy-based management,
>  instant
>  > alerts, and centralized management of a widely-distributed user base.
>  >
>  > Founded in 1988, F-Secure Corporation is listed on the Helsinki Stock
>  > Exchange (HEX: FSC). The company is headquartered in Espoo, Finland with
>  > North American headquarters in San Jose, California, as well as offices 
in
>  > Canada, Germany, China, France, Japan and the United Kingdom. F-Secure
>  > Corporation is supported by a network of VARs and Distributors in over 90
>  > countries around the globe.
>  >
>  > For more information, please contact
>  >
>  > Finland:
>  > F-Secure Corporation
>  > Mr. Mikko Hyppönen, Manager, Anti-Virus Research.
>  > PL 24
>  > FIN-02231 ESPOO
>  > Tel +358 9 8599 0513
>  > Fax +358 9 8599 0599
>  > E-mail: [log in to unmask]
>  >
>  > USA:
>  > F-Secure Inc.
>  > Mr. Dan Takata, Manager, Training Division, Professional Services
>  > 675 N. First Street, 8th Floor
>  > San Jose, CA 95112
>  > Tel. +1 408 938 6700,
>  > Fax  +1 408 938 6701
>  > e-mail [log in to unmask]
>  >
>  > http://www.F-Secure.com/
>  >
>  >
>  > Mailing list policy
>  >
>  > You have previously expressed interest in our products, or have asked
>  > to be included on one of our press release lists by personally giving us
>  > your e-mail address for this purpose.Our mailing list are for the
>  > exclusive use and the expressed purpose of F-Secure and are not
>  > sold or or given to third parties.
>  >
>  > If you no longer wish to receive our press releases, or your email 
address
>  > has been added to our lists without your consent, you can unsubscribe at
>  > http://www.F-Secure.com/news/subscribe.html
>  >
>  > If you only wish to receive our press releases concerning viruses,
>  > please go to
>  > http://www.F-Secure.com/news/subscribe.html
>  > and first unsubscribe from
>  > [log in to unmask]
>  > and then subscribe to
>  > [log in to unmask]
>  >
>  -------------end forwarded message