Nothing To Fear About Script Viruses - Sophos

Sophos, the anti-virus specialist, advised that users have nothing to
fear from the recent rash of script viruses - provided, of course,
that they install a patch from Microsoft to protect them.

Sophos said that viruses such as Kakworm and Bubbleboy can be stopped
in their tracks if users down a update from Microsoft's Web site at
http://www.microsoft.com/technet/security/bulletin/ms99-032.asp .

The anti-virus firm said it has issued its advisory after the arrival
of GodMessage, a new hackers' toolkit that uses the same
vulnerabilities as the Kakworm virus to install backdoor Trojans on
infected computers.

The kit, available for download from underground Web sites, enables
relatively unskilled hackers, script kiddies and virus writers to
easily create viruses loaded with backdoor Trojans.

Sophos said that the kit uses a vulnerability in Microsoft's
implementation of ActiveX that allows a virus to hide in the text
body of an e-mail.

This type of virus, the company said, has become extremely
widespread, largely due to the fact that MS Outlook and Outlook
Express users activate it simply by reading an infected e-mail.

Graham Cluley, the firm's senior technology consultant, said that
there really shouldn't be any danger from this sort of script virus.

"Installing this patch takes seconds and will provide permanent
protection from all viruses that use this kind of attack. However, we
continue to see more cases of Kakworm than any other virus. It seems
that the message still needs to be hammered home," he said.

According to Cluley, to protect against viruses written using
GodMessage, users should disable Windows Scripting Host by going to
http://www.sophos.com/support/faqs/wsh.html and downloading the patch
from Microsoft.