$VER: Kuang11Update.readme 2.34 (5.2.99) Kuang11 Update changes ********************************************************** ********** ********** ********** Virus warning! You MUST read this! ********** ********** ********** ********************************************************** VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Warning ******* All Kuang Eleven users who have received an update in the past few weeks are at risk! Two viruses have been released via the update server attached to different versions of the file rexxkuang11.library (normally placed in LIBS:), and also affecting the file C:Mount. Details ******* The two versions of the library which were infected are shown below, along with some details: rexxkuang11.library 0.36 ( 4/02/99) =================================== - File size: 31,172 - Attaches itself to your C:Mount file (any version) unless SnoopDOS is running - Performs "run >NIL: newshell TCP:2551" (both the library and C:Mount) - Allows remote CLI (shell) access to your computer - Calls itself "Vaginitis #2" by "STD" - Does NOT spread to any other files (other than C:Mount) rexxkuang11.library 0.27 (27/12/98) =================================== - File size: 26,532 bytes - Performs "RUN >NIL: newshell tcp:2333" when the library is opened - Allows remote CLI (shell) access to your computer - Calls itself "Vaginitis #3" by "STD" - Does NOT spread to any other files Solution ******** · You should have received version 0.37 (or later) of rexxkuang11.library with this update. You should verify this by typing: Version LIBS:rexxkuang11.library FILE FULL You should get the response: rexxkuang11.library 0.37 ( 5/02/99) or a later version. · Reboot your system (if possible, do NOT go online). · Replace the file C:Mount from your original disks, or some other reliable source. · Reboot AGAIN. If you have any copies of rexxkuang11.library versions 0.27 and 0.36, they should be deleted, as these were never legitimately uploaded to the update server. Explanation *********** The server at which the Amiga Coding Syndicate's updates are stored was hacked by an unknown, malicious person or persons. We have changed our passwords and have made every effort to secure our site. We sincerely regret any inconvenience this has caused anyone. If you wish to eliminate auto-updates from your Kuang Eleven installation, simply rename or delete the file Rexx/Kuang11UPD.amirx (relative to your AmIRC directory).