{Fair use for educational purposes.]

From CNN:

"CA warns of Y2K-triggered virus"

December 31, 1999 "(IDG) -- Computer Associates International Inc. (CA) Friday warned users of two new viruses, one of which the company said is set to be triggered by the Year 2000 rollover."

"CA said the "Trojan.Kill_Inst98" virus will delete all the files on an infected PC's C: drive when the system clock rolls over to Jan. 1, 2000. According to the company, it has been distributed through pirated copies of Microsoft Windows 98 and can be spread through e-mail and through sharing drives and floppy disks."

"Trojan.Kill_Inst98" saves the current date into the file c:\windows\system32\wb32off.txt."

"According to CA, before the year change, the virus alters the KEYB.COM file to cause Windows to begin using the Spanish keyboard setting." "Also today, CA warned of a new worm virus that uses Microsoft Outlook address books to propagate itself through e-mail messages."

"If it is run, the virus can cause a PC to load it every time the system is restarted, and it will attempt to propagate itself again, according to CA."

"Like some earlier worm viruses, the "VBS.Tune.A" virus copies addresses from a user's Outlook address book and sends e-mail to all those users. Because it takes the addresses from a user's own address book, it may appear to recipients as mail from a trusted associate."

"The virus creates a message with the subject line "Please read" and the message "Hey, you really need to check this file I sent you....please check it out as soon as possible." An file called "Tune.VBS" is attached."

"If the attachment is run, it will create the file "VBScript" in the PC's Windows and Windows\System directories. It will create registry keys to make sure it is automatically loaded every time the PC is restarted. After that, it will copy itself to the root of all local and network drives, but does not make any registry settings on those drives."

"The virus then attempts to use two IRC (Internet Relay Chat) clients, MIRC and PIRCH, to spread itself when the next IRC session is started."

"These are the registry keys that "VBS.Tune.A" creates in a user's system, according to CA:"

"HKEY_Current_User\Software\ Microsoft\Windows\CurrentVersion\ Run\ScanRegistry" "HKEY_Current_User\Software\ Microsoft\Windows\CurrentVersion\ Run\Taskmonitor"

"More information on "VBS.Tune.A" can be found at www.cai.com/virusinfo, and information on Trojan.Kill_Inst.98 will also be available at that site, according to CA. CA said users can download virus protection software from www.antivirus.cai.com."

-- Deb M. (vmcclell@columbus.rr.com), December 31, 1999