Re: Virus in an e-mail

[Guest guest]

I found the kak.htm file on my computer. How do I get rid of the virus? I

deleted the file, anything else I can do?

e Quinby

Teacher and Consultant

www.autismbehaviorconsult.com

(under construction)

[ ] Virus in an e-mail

It looks like the KAK worm virus has just arrived on . This has

just been discussed at length on the ABA-UK list.

My ancient e-mail software which (I hope) won't run or attach e-mail

viruses showed that some 'script' in an e-mail sent last night (30/3/00

20:39) which clearly was the KAK virus. This also had a picture file

attached ( " CPBTOOLSWINTEMPnsmailGC.gif " ) which was not mentioned by the

sender. (I have not tried to look at this picture!)

Since that e-mail, I see 3 messages from other members of reporting

a possible Virus. It is possible no-one else can see what I see (ie., the

raw script) because everyone else is using more up to date software which

takes the script and runs it (or detects it - it is ActiveX related).

I am not a Virus expert so if anyone else knows more, please let everyone

else know.

I have not resent the script in case it reactivates itself in more modern

software. Below is a message sent to ABA-UK by , the list moderator

which may help.

>More from Alan:

>

>Here in plain english (I hope) is what you need to know about the kak virus

>and how to stop it. The virus has two stages. 1) Infection and 2)

>Propagation (spreading).

>

>To get infected with the kak virus you have to:

>a) Read (or preview) an infected HTML (rich text) formatted email; or

> Visit a malicious website which has the virus

>

>Note, you can be infected via any program that supports HTML and ActiveX

>(such as a web browser or email client) not just Outlook Express.

>

>The virus infects Windows PCs by exploiting a bug in an ActiveX control.

>There is a patch available from Microsoft to block this bug. This can be

>downloaded from Microsoft at

>http://www.microsoft.com/technet/security/bulletin/ms99-032.asp and should

>be installed as it also fixes another security bug.

>

>If your PC has been infected with the kak virus you will find some (or all)

>of the following files on your PC:

>c:\windows\kak.htm

>c:\windows\system\xxxxxxxx.hta (xxxxxxxx=random 8 character name)

>c:\windows\Menu Démarrer\Programmes\Démarrage\kak.hta

>c:\windows\Start Menu\Programs\StartUp\kak.hta

>

>Once a PC has been infected, the kak virus spreads via Outlook Express

>(version 5). It does this by adding itself to each HTML (rich text)

>formatted email sent by Outlook. This is totally unknown to the user.

>

>To avoid spreading the virus you can:

>a) Don't use Outlook Express

> Don't send messages in HTML (rich text) format

>c) Make sure you don't have the kak virus

>

>Hope this is understandable and helps people to clear up the virus.

>

>

>

------------------------------------------------------------------------

Good friends, school spirit, hair-dos you'd like to forget.

Classmates.com has them all. And with 4.4 million alumni already

registered, there's a good chance you'll find your friends here:

1/2623/2/_/659983/_/954491822/

------------------------------------------------------------------------

[Guest guest]

I'm not a virus expert but I did a quick web search and found some advice

at the following web page:

http://www.pchell.com/internet/kakworm.shtml

At 23:48 31/03/00 -0500, you wrote:

>I found the kak.htm file on my computer. How do I get rid of the virus? I

>deleted the file, anything else I can do?

>

>e Quinby

>Teacher and Consultant

>www.autismbehaviorconsult.com

>(under construction)

> [ ] Virus in an e-mail

>

>

>It looks like the KAK worm virus has just arrived on . ........