Summary
Kak is a worm that - like BubbleBoy - embeds itself without any attachment to every email sent from the infected system. For further information about BubbleBoy, see the description: https://www.F-Secure.com/v-descs/bubb-boy.shtml
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Kak is written in JavaScript and it works on both English and French versions of Windows 95/98 if Outlook Express 5.0 is installed. It does not work in a typical Windows NT installation.
The worm uses a known security vulnerability that is in Outlook Express. Once the user receives an infected email message and opens or views the message in the preview pane, the worm creates a file "kak.hta" to the Windows Startup directory.
Next time the system is restarted, the worm activates. It replaces "c:\autoexec.bat" with a batch file that deletes the worm from the Startup directory. The original "autoexec.bat" is copied to "C:\AE.KAK".
Also, It modifies the message signature settings of Outlook Express 5.0 by replacing the current signature with an infected file, "C:\Windows\kak.htm".
Therefore every message sent with Outlook Express will contain the worm after this has been done.
Then it modifies the Windows registry in such a way that it will be executed in every system startup. The key it adds to the registry is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cAg0u
The .hta file that the virus creates and executes in the future is saved to Windows System directory. On the first day of each month, if the number of hours is more than 17 (i.e. 6pm or later), the worm will show an alert box with the following text:
Kagou-Anit-Kro$oft say not today!
Then the worm shuts down Windows.
F-Secure Anti-Virus detects the worm. When the worm has been detected, the user should delete the following files, if they exist:
C:\Windows\kak.htm C:\Windows\System\(filename).hta
where (filename) is a variable, and it changes from one system to another
C:\Windows\Start Menu\Programs\Startup\kak.hta C:\Windows\Menu Demarrer\Programmes\Demarrage\kak.hta
The "autoexec.bat" file can be restored by renaming "C:\AE.KAK" to "C:\autoexec.bat".
Kak uses a known security hole in Microsoft Outlook Express to create the local HTA file.
If active scripting is disabled from Outlook Express, the worm will not work.
Microsoft has more information on this problem available at: https://www.microsoft.com/technet/security/bulletin/fq99-032.asp
They also have a patch to fix this problem at: https://www.microsoft.com/technet/security/bulletin/ms99-032.asp