Vendor Reports New Worm Viruses

Welcome Guest. | Log In| Register | Membership Benefits

March 30, 2000 (2:03 PM EST)

By Mo Krochmal,

Two new software programs circulating on the Internet could damage computer files, a software vendor said Thursday.

F-Secure, San Jose, Calif., formerly known as Data Fellows, said Thursday that two worms are spreading rapidly in Windows-based computer networks. They are similar to the infamous Melissa virus. According to a the company, both programs spread via users of the Microsoft Outlook e-mail program -- but in two different ways. Irok propagates through a file attachment called IROK.EXE, while the Kak worm arrives within an e-mail message.

"We are aware of Irok and Kak and have had a few reports of Kak, but nothing significant yet," said a spokesman from CERT, a nonprofit organization at Carnegie Mellon University that tracks computer viruses.

Last year, the Melissa virus spread rapidly, clogging networks and, in some cases, destroying data. The writer of that virus plead guilty to a charge of computer theft and faces a minimum five-year prison term.

Viruses are one of the biggest security problems in information technology. According to a survey conducted by the accounting firm PriceWaterhouseCoopers last summer, about 64 percent of companies worldwide were hit by at least one virus in the previous 12 months, up from 53 percent the year before. In the United States, viruses hit 69 percent of companies.

The vendor on Thursday said the Kak worm is written in Javascript and works under English and French language versions of the Windows 95/98 operating system only and works only with Outlook Express 5.0. It executes automatically when e-mail is viewed and replaces the standard e-mail signature of the user with an HTML file. The worm activates on the first day of each month if the machine is restarted after 5 p.m. It displays a message and then shuts down Windows.

Users can stop the virus by disabling "Active Scripting" in the preferences file.

The Irok worm spreads through an executable file that affects systems running Windows 95, 98, NT, and 2000. It replicates further if Outlook mail is available.

When started, the program modifies a system so that the next time the machine is started, the worm sends an e-mail message to 50 e-mail addresses found in Outlook address books. The message has the subject line of "I thought you might like to see this" and has a text message saying "I thought you might like this. I got it from paramount pictures. It's a startrek [sic] screen saver," the vendor said.

The virus tries to propagate through chat clients and will try to overwrite files on the hard drive.