On 21 May 2000, at 12:09, John Walker wrote:
> CSS Internet News Virus Update
>
> NewLove virus not nearly as widespread as LoveLetter
>
SNIP
The *Worm* Helen Johnsd sent was not NewLove John... It was Kak.
http://www.f-secure.com/v-descs/kak.htm
F-Secure Virus Information Pages
NAME: Kak ALIAS: Wscript.KakWorm, KakWorm
Kak is a worm that embeds itself to every email sent from the infected system,
without any attachment, like BubbleBoy does. For further information about
BubbleBoy, see the description:
http://www.F-Secure.com/v-descs/bubb-boy.htm
Kak is written in JavaScript and it works on both English and French versions
of Windows 95/98 if Outlook Express 5.0 is installed. It does not work in a
typical Windows NT installation.
The worm uses a known security vulnerability in Outlook Express. Once the
user receives an infected email message, and opens or views the message
in the preview pane, the worm creates a file "kak.hta" to the Windows
Startup directory.
Next time when the system is restarted, the worm activates. It replaces
"c:\autoexec.bat" with a batch file that deletes the worm from the Startup
directory. The original "autoexec.bat" is copied to "C:\AE.KAK".
It also modifies the message signature settings of Outlook Express 5.0
replacing the current signature with an infected file, "C:\Windows\kak.htm".
Therefore every message sent with Outlook Express after that will contain
the worm.
Next it modifies the Windows registry in a such way that it will be executed
in every system startup. The key it adds to the registry is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cAg0u
The .hta file that the virus creates and will be executed is saved to Windows
System directory. In first day of each month if the number of hours is more
than 17 (i.e. 6pm or later), the worm will show an alert box with the following
text:
Kagou-Anit-Kro$oft say not today!
Then the worm causes the Windows to shut down.
F-Secure Anti-Virus detects the worm. When the worm has been detected,
the user should delete the following files, if they exist:
C:\Windows\kak.htm
C:\Windows\System\(filename).hta
where (filename) is a variable, and it changes from one system
to another
C:\Windows\Start Menu\Programs\Startup\kak.hta
C:\Windows\Menu Demarrer\Programmes\Demarrage\kak.hta
The "autoexec.bat" can be restored by copying the "C:\AE.KAK" to
"C:\autoexec.bat".
Kak uses a known security hole in Microsoft Outlook Express to create
the local HTA file.
If active scripting is disabled from Outlook Express, then the worm will not
work.
Microsoft has more information on this problem available at:
http://www.microsoft.com/Security/Bulletins/MS99-032faq.asp
They have also a patch to fix this problem at
http://www.microsoft.com/security/Bulletins/ms99-032.asp
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
*************************************
All the best John & everyone .......... murray
ps: I like your "Snoopy" ASCII art signature...
[log in to unmask]
View the Parkinson's Awareness Links at:
http://www.geocities.com/janet313/pienet/wwweb/index.html
