versions of Windows 95/98 if Outlook Express 5.0 is installed. It does
not work in a typical Windows NT installation.
The worm uses a known security vulnerability that is in Outlook
Express. Once the user receives an infected e-mail message and opens
or views the message in the preview pane, the worm creates a file
"kak.hta" to the Windows Startup directory.
Next time the system is restarted, the worm activates. It replaces
"c:\autoexec.bat" with a batch file that deletes the worm from the
Startup directory. The original "autoexec.bat" is copied to
Also, It modifies the message signature settings of Outlook Express
5.0 by replacing the current signature with an infected file,
Therefore every message sent with Outlook Express will contain the
worm after this has been done.
Then it modifies the Windows registry in such a way that it will be
executed in every system startup. The key it adds to the registry is:
The .hta file that the virus creates and executes in the future is
saved to Windows System directory. On the first day of each month,
if the number of hours is more than 17 (i.e. 6pm or later), the worm
will show an alert box with the following text:
Kagou-Anit-Kro$oft say not today!
Then the worm shuts down Windows.
F-Secure Anti-Virus detects the worm. When the worm has been detected,
the user should delete the following files, if they exist:
where (filename) is a variable, and it changes from one system
The "autoexec.bat" file can be restored by renaming "C:\AE.KAK" to
Kak uses a known security hole in Microsoft Outlook Express to create
the local HTA file.
If active scripting is disabled from Outlook Express, the worm will
Microsoft has more information on this problem available at:
They also have a patch to fix this problem at:
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]