Virus Name: VBS.KakWorm.F@m

Aliases: VBS/Kakworm-F, JS.KakWorm.z, JS_KakWorm.F, JS/Kak@M, I-Worm.KakWorm.z

KakWorm is a Visual Basic script worm similar to Bubble Boy. It only spreads if Outlook Express sends it, and only works if Internet Explorer is installed.

KakWorm drops kak.hta into Windows Startup, to be loaded the next time Windows runs. And it makes the file kak.htm, which it places in the Windows folder.

This script worm also makes changes to the registry so that kak.htm is used as Outlook Express’ signature on every out going message.

And, on the first of the month after 5 pm, the message, “Kagou-Anti-Kro$oft says not today,” appears and Windows’ shutdown is run.

Privacy	Copyright	About
Contact	Site Map	Blog Frog