Chinese Internet-worm awakes!

26 Apr 2000
Virus News

Detection for this worm has been added to AVP anti-virus database... 1 MONTH AGO!

Cambridge, UK, April 27, 2000 - Kaspersky Lab Int., a fast-growing international anti-virus software development company, alerts users about the epidemic of a new Internet worm I-Worm.Unicle.

This worm has been discovered by Kaspersky Lab anti-virus experts a month ago. At the same time detection for it has been successfully added to AntiViral Toolkit Pro (AVP) anti-virus database. Regrettably, the majority of anti-virus vendors started to produce patches for their products only now, when the epidemic has begun.

"The distinctive nature of this worm is that it is able to spread via e-mail without using attachments. To pass the worm to a computer, a user only need to READ the infected message. Despite the fact that the "Unicle" worm is capable of operating only under Chinese Windows, we anticipate the emergence of its new variation, which is compliant with other Windows versions," said Eugene Kaspersky, Head of Anti-Virus Research at Kaspersky Lab. "We strongly recommend computer users to update their anti-virus programs and urgently install a patch for MS Internet Explorer."

How to protect against "Unicle" worm?

Microsoft has released an update that eliminates security "Scriptlet.Typelib" vulnerability. We strongly recommend you visit and install this update.

If you do not use any HTML applications (HTA-files), there is another way to prevent infection by viruses of such type (the worms and viruses that use "Scriptlet.Typelib" security vulnerability). You need to remove file association for .HTA extension. To do this you have to follow these steps:

1. Double click "My Computer" icon on desktop.

2. In appeared window choose menu "View" -&bg; "Options..."

3. On "File Types" tab in "Registered file types" listbox select

"HTML Applicaton" item.

4. Click "Remove" button and confirm action.

5. Close options dialog box.

Technical Details