December 31, 1999 Web posted at: 11:33 a.m. EST (1633 GMT) by Stephen Lawson

From...

(IDG) -- Computer Associates International Inc. (CA) Friday warned users of two new viruses, one of which the company said is set to be triggered by the Year 2000 rollover.

CA said the "Trojan.Kill_Inst98" virus will delete all the files on an infected PC's C: drive when the system clock rolls over to Jan. 1, 2000. According to the company, it has been distributed through pirated copies of Microsoft Windows 98 and can be spread through e-mail and through sharing drives and floppy disks.

"Trojan.Kill_Inst98" saves the current date into the file c:\windows\system32\wb32off.txt.

According to CA, before the year change, the virus alters the KEYB.COM file to cause Windows to begin using the Spanish keyboard setting.

	ALSO
For more ITN millennium coverage, visit ITN on line.

Also today, CA warned of a new worm virus that uses Microsoft Outlook address books to propagate itself through e-mail messages.

If it is run, the virus can cause a PC to load it every time the system is restarted, and it will attempt to propagate itself again, according to CA.

MORE COMPUTING INTELLIGENCE

IDG.net home page

Make your PC work harder with these tips

Download free PC software fast

IDG.net's personal news page

IDG.net's products pages

Reviews & in-depth info at IDG.net

E-BusinessWorld

Year 2000 World

Questions about computers? Let IDG.net's editors help you

Subscribe to IDG.net's free daily newsletters

Search IDG.net in 12 languages

News Radio

Fusion audio primers

Computerworld Minute

Like some earlier worm viruses, the "VBS.Tune.A" virus copies addresses from a user's Outlook address book and sends e-mail to all those users. Because it takes the addresses from a user's own address book, it may appear to recipients as mail from a trusted associate.

The virus creates a message with the subject line "Please read" and the message "Hey, you really need to check this file I sent you....please check it out as soon as possible." An file called "Tune.VBS" is attached.

If the attachment is run, it will create the file "VBScript" in the PC's Windows and Windows\System directories. It will create registry keys to make sure it is automatically loaded every time the PC is restarted. After that, it will copy itself to the root of all local and network drives, but does not make any registry settings on those drives.

The virus then attempts to use two IRC (Internet Relay Chat) clients, MIRC and PIRCH, to spread itself when the next IRC session is started.

These are the registry keys that "VBS.Tune.A" creates in a user's system, according to CA:

HKEY_Current_User\Software\ Microsoft\Windows\CurrentVersion\ Run\ScanRegistry

HKEY_Current_User\Software\ Microsoft\Windows\CurrentVersion\ Run\Taskmonitor

More information on "VBS.Tune.A" can be found at www.cai.com/virusinfo, and information on Trojan.Kill_Inst.98 will also be available at that site, according to CA. CA said users can download virus protection software from www.antivirus.cai.com.