Re: KAK.HTA

Article View: comp.os.ms-windows.misc

Article #3075

Back to comp.os.ms-windows.misc Previous Next

#3075

From: chip
Date: Wed, 02 Aug 2000 00:00

28 lines
2000 bytes

Negative!  This type of virus is transmitted through this type
of newsgroup.  As soon as you open a topic, it will write itself
to your IE5 temp file.  It then will go to the registry upon
opening and make the following changes:

HKCU/Identities/
{Identity}/Software/Microsoft/Outlook/Express/5.0/signatures
This is how the virus spreads by attaching to the signature
feature.  This causes all outgoing mail to be appended by the
worm. It also changes the registry key:

HKLM/Software/Microsoft/Windows/CurrentVersion/Run/cAgOu

This causes the worm to be executed each time the computer is
booted.

Removal is easy.  1) Delete file:  KAK.HTA or KAK.htm
2)Delete the above registry key:
HKLM/Software/Microsoft/Windows/CurrentVersion/Run/cAgOu

Good Luck, as you can see.  Been there, done that.


-----------------------------------------------------------

Got questions?  Get answers over the phone at Keen.com.
Up to 100 minutes free!
http://www.keen.com

Technical Details

Message-ID: <015d961c.37578f4e@usw-ex0102-013.remarq.com>

Path: arc1-ca.pugleaf.net!unknown!not-for-mail

References:

<nJ1h5.56656$N4.1791966@ozemail.com.au> <Pine.OSF.4.21.0007311345490.14998-100000@student.uq.edu.au> <8m2ue1$6ki$1@gxsn.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1102f1,1bcd5040a7c36e64
X-Google-Attributes: gid1102f1,public
X-Google-Thread: 1070cf,1bcd5040a7c36e64
X-Google-Attributes: gid1070cf,public
X-Google-Thread: 108c83,1bcd5040a7c36e64
X-Google-Attributes: gid108c83,public
From: chip <csc51NOcsSPAM@juno.com.invalid>
Subject: Re: KAK.HTA
Date: 2000/08/02
Message-ID: <015d961c.37578f4e@usw-ex0102-013.remarq.com>
X-Deja-AN: 653573253
References: <nJ1h5.56656$N4.1791966@ozemail.com.au> <Pine.OSF.4.21.0007311345490.14998-100000@student.uq.edu.au> <8m2ue1$6ki$1@gxsn.com>
Bytes: 987
X-Originating-Host: 207.203.144.253
X-Complaints-To: wrenabuse@remarq.com
X-Trace: WReNphoon3 965217024 10.0.2.13 (Wed, 02 Aug 2000 04:50:24 PDT)
Organization: http://www.remarq.com: The World's Usenet/Discussions Start Here
NNTP-Posting-Date: Wed, 02 Aug 2000 04:50:24 PDT
Newsgroups: comp.os.ms-windows.misc,alt.windows98,aus.computers
X-Wren-Trace: eEtuRkdeGVMYCExAG1pqSExWVABNQAYdHBcTBhAPAUUVGV8EF14N

Reply to Parent Message