Threat behavior
Most JS/Kak variants take the following actions:
- Set values in the following registry keys:
HKEY_CURRENT_USER\Identities\<identity name>\Software\Microsoft\Outlook Express\5.0:Signature Flags
HKEY_CURRENT_USER\Identities\<identity name>\Software\Microsoft\Outlook Express\5.0\signatures:Default Signature
HKEY_CURRENT_USER\Identities\<identity name>\Software\Microsoft\Outlook Express\5.0\signatures\00000000:name
HKEY_CURRENT_USER\Identities\<identity name>\Software\Microsoft\Outlook Express\5.0\signatures\00000000:type
HKEY_CURRENT_USER\Identities\<identity name>\Software\Microsoft\Outlook Express\5.0\signatures\00000000:text
HKEY_CURRENT_USER\Identities\<identity name>\Software\Microsoft\Outlook Express\5.0\signatures\00000000:file
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(The <identity name> is a GUID that represents a user of the computer.)
- Create infected files such as the following, using various names:
- A file with extension .htm in the location indicated by registry key:
HKEY_CURRENT_USER\Identities\<identity name>\Software\Microsoft\Outlook Express\5.0\signatures\00000000:file
- A file with extension .hta. The worm places the .hta file in the Startup folder when the exploit occurs. When Windows starts again, the worm:
- Runs automatically due to the addition of the .hta file to the Startup folder.
- Creates an entry in registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
which causes the worm to run each time Windows starts subsequently.
- Modifies the autoexec.bat file to delete itself from the Startup folder the next time Windows starts.
-
A file in C:\.
Some JS/Kak variants perform other operations, including:
- Modifying the Internet Explorer default start page.
- Displaying messages. This behavior can be triggered by the time of day or day of the month. Following are three examples of such messages:
Kagou-Anti-Kro$oft says not today !
Days It was a day to be a days
Damn I hate email script virii!
-
Shutting down the computer unexpectedly.
-
Creating a file to track the number of times the virus has executed.
-
Modifying a registry key so that each time an executable file is launched, notepad.exe runs instead.
Prevention
Take the following steps to help prevent infection on your system:
-
Enable a firewall on your computer.
-
Get the latest computer updates.
-
Use up-to-date antivirus software.
-
Use caution with unknown attachments.
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
-
Click Start, and click Control Panel.
-
Click Network and Internet Connections, and click Network Connections. If you do not see Network and Internet Connections, click Switch to Category View.
-
Highlight a connection that you want to help protect, and click Change settings of this connection.
-
Click Advanced, and select Protect my computer and network by limiting or preventing access to this computer from the Internet.
-
Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates in Windows XP
-
Click Start, and click Control Panel.
-
Click Performance and Maintenance. If you do not see Performance and Maintenance, click Switch to Category View.
-
Click System.
-
Click Automatic Updates, and select Keep my computer up to date.
-
Select a setting. Microsoft recommends selecting Automatically download the updates, and install them on the schedule that I specify and setting a regular update time.
-
If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.
Use up-to-date antivirus software
Most antivirus software can detect and prevent infection by known malicious software. You should always run antivirus software on your computer that is updated with the latest signature files to automatically help protect you from infection. If you don't have antivirus software installed, you can get it from one of several companies. For more information, see http://www.microsoft.com/athome/security/downloads/default.mspx
