Wscript.Kak Scanner and Remover description

   
Easily remove the Wscript/Kak email worm from an infected worm

Wscript/Kak is a worm that will exploit security vulnerabilities in Internet Explorer and Microsoft Outlook in a way similar to Bubbleboy worm. It will only infects computers running Microsoft Windows 98 with Internet Explorer 5 and Outlook Express or Outlook.

When viewing the e-mail in Outlook or Outlook Express, the VBScript code in it will create "KAK.HTA" in startup directory. This file will be run at next startup, it will create KAK.HTM in windows folder and and changes the Microsoft Outlook Express registry settings so that the KAK.HTM is automatically included in every outgoing message as a signature. The KAK.HTA also changes the Windows registry that it includes the name of the worm file.

On the 1st of any month after 5 p.m. the worm displays the message "Kagou-Anti_Kro$oft says not today" and runs Windows shutdown

Options:
· /SCAN - Scans the system for Wscript.Kak worm
· /REPAIR - Use this option to CLEAN the worm
· /ALL - Scan all files
· /SCAN - Scan all files
· /BAK - Create backup copy before cleaning
· /NOSUB - Sub Directories OFF
· /REPORT - Generates report - C:/VIRUSCAN.RPT
· /HELP - Detailed help to clean the Wscript.Kak worm

Size / OS:     18 KB / Windows 9X