Need help? Ask the community or hire an expert.
Go to Avira Answers
Alias:JS/Kak@M, Worm/KakWorm
Type:Worm 
Size:0 Bytes 
Origin: 
Date:06-08-2000 
Damage:Sent by email. 
VDF Version:6.20.00.00 
Danger:Medium 
Distribution:Medium 

DistributionIt changes the Microsoft Outlook Express 5 registry settings, so that the file "%Windows%\KAK.HTM" is attached as signature to every composed email
If you already use a signature, it will no longer be used.

Technical DetailsWurm KAK only attacks English and French Windows 95/98 systems. It uses Microsoft Internet Explorer 5 to spread the infection, and Microsoft Outlook Express 5, as email Client. This means that the virus can be attached to every HTML email as Java Script.
It creates the file "KAK.HTA" in Windows autostart directory. It will be activated by the next system start. A window named "Driver Memory Error" will shortly display a message: "S3 driver memory alloc failed". In this time, the virus copies itself in Windows system directory with a new file name. This name is composed out of the first 8 letters of the last directory in the folder:
C:\%WinDIR%%\Application Data\Identities.

The worm is copied as "KAK.HTM" in Windows directory and modified, so that it can relaunch its attack.
The following registry entries are modified:
[HKEY_CURRENT_USER\Identities\\Software\
Microsoft\Outlook Express\5.0\signatures]
"Default Signature"="00000000"
[HKEY_CURRENT_USER\Identities\
{DA71B880-3169-11D4-85A2-0020AFB6B97D}
\Software\Microsoft\Outlook Express\5.0\
signatures\00000000]
"name"="Signature #1"
"type"=dword:00000002
"text"=""
"file"="C:\\%WinDIR%\\kak.htm"

After completing its action, the worm modifies AUTOEXEC.BAT, so that the next time the system is restarted, the created files are deleted from autostart directory:
@echo off>C:\%WinDIR%\STARTM~1\Programs\StartUp\kak.hta
del C:\%WinDIR%\STARTM~1\Programs\StartUp\kak.hta
The original is saved as AE.KAK. But to ensure its activity, the new file is entered in the autostart registry of Windows System directory:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "cAg0u"="C:\\%WinDIR%\\%SystemDIR%\\DA71B880.hta"

If Windows is started at 17:00 hours on the 1st of every month, the virus displays a message:
"Kagou-Anti-Kro$oft says not today!"
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .