Subject: [NEWS] Resume and KAK Viruses are spreading Date: Sat, 27 May 2000 23:32:24 +0200 Resume and KAK Viruses are spreading -------------------------------------------------------------------------------- SUMMARY Two new e-mail Viruses are running wild. The Resume Virus is a variant of Melissa, with a more vicious payload. And at the same time, Kak is beginning to live up to its advance billing as the world's number 1 Virus this summer. Details about those Viruses and how to stop them, below. DETAILS Resume The Resume Virus (also known as Melissa.BG) is a very dangerous Word Macro Virus. It attempts to send copies of itself to everyone in the address book and tries to delete all files in the following directories and drives: C:\*.* C:\My Documents\*.* C:\WINDOWS\*.* C:\WINDOWS\SYSTEM\*.* C:\WINNT\*.* C:\WINNT\SYSTEM32\*.* A:\*.* [may cause an error message] B:\*.* [may cause an error message] As well as *.* in the root of drives D: thru Z: The email message in which it arrives looks like this: Subject: Resume - Janet Simons To: Director of Sales/Marketing, Attached is my resume with a list of references contained within. Please feel free to call or email me if you have any further questions regarding my experience. I am looking forward to hearing from you. Sincerely, Janet Simons. "Explorer.doc" Actions Required: The correct action is to ensure no one opens the attachment and if you have the skills, set up email filters that stop such messages. Tell people to deactivate their preview feature in Microsoft Outlook, and only then delete the e-mail without opening. Valuable data from the top virus vendors: Norton Anti Virus: http://vil.nai.com/villib/dispvirus.asp?virus_k=98661 Symantec: http://www.symantec.com/avcenter/venc/data/w97m.melissa.bg.html The KAK Virus: Fifty thousand systems received the KAK virus on May 24. See: http://www.msnbc.com/news/412717.asp The story, in brief, is that 50,000 clients of Shoppingplanet.com received an infected email newsletter (not an attachment) and those who previewed or read the email in Outlook Express almost certainly became infected. The MSNBC reporter goes on to say: "Kak is one of the first of a new breed of viruses that can infect users simply when they read an e-mail, or even by previewing an e-mail using Microsoft's Outlook Express - opening an attached file is not required. After infection, the virus sends a copy of itself with every message the victim sends. The virus payload, however, is not malicious. It does not attempt to delete any files." Impact: It's very important not to confuse between the two Viruses. Although the 'Kak' Virus can attack without opening any attachment, it does not do any damage. There is no known Virus that can do damage just by previewing or reading an e-mail. The Resume Virus, however, is dangerous - and activated via a Word Macro (an attack which is well-known since Melissa). ADDITIONAL INFORMATION The information has been provided by: Steve. ======================================== DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.