Forum Home
Press F1
 
Thread ID: 25155 2002-09-27 09:39:00 KakWorm virus Susan B (19) Press F1
Post ID Timestamp Content User
83749 2002-09-27 09:39:00 I'll be surprised if anyone has a solution to this one . ;-)

A couple of years ago I got a KakWorm virus from a cousin's email . Norton antivirus picked it up straight away and I gave it permission to "repair" the file, whereupon it took out my Inbox along with all the messages in it, including a few that were unread X-( .

It's a complicated story but to cut it short I got rid of the KakWorm - eventually - and Norton nor the online Trend virus scan has picked anything up since .

Until today .

The Girl ran Nortons over the hard drive this afternoon and to my utter and complete surprise it declared that the WScript . KakWorm . dr was in one of my . dbx folders . This folder only contains saved html email birthday cards that I have created and sent to people . Nothing in there has been received from anyone . And the last one is dated 17/07/01 .

Knowing that Norton will delete the entire folder I have left it, for now . What I'd like to know is how on earth the KakWorm got in there, in my own creations, and how come it hasn't been picked up before now?

Is Norton telling lies???? :O
Susan B (19)
83750 2002-09-27 10:18:00 Susan B. What would happen if you ran another, different, anti-virus program after the first one (Nortons in your case). Would they conflict ?
Poppa John
Poppa John (284)
83751 2002-09-27 10:28:00 Have you run the Symantec online virus scanner Susan?

I wouldn't trust the Housecall scanner as far as I could throw it.
Baldy (26)
83752 2002-09-27 10:40:00 Hi Susan

Nortons might not wipe the folder this time, so make a copy of it somewhere else then scan the original and see if Nortons will remove the virus. If the folder remains afterwards with the rest of the data intact, delete the spare. If it kills the folder completely, go back to square one, do not pass go and do not collect $200.

Just a thought.

Cheers

Billy 8-{) :D
Billy T (70)
83753 2002-09-27 10:42:00 Not much help for your problem - but I found this tidbit interesting whilst searching ....

A brief history of viruses

1949 Mathematician John von Neumann suggests that computer programs could reproduce.

1950s Bell Labs develop an experimental game in which players use malicious programs to attack each others computers.

1975 Sci-fi author John Brunner imagines a computer “worm” spreading across networks.

1984 Fred Cohen introduces the term “computer virus” in a thesis on such programs.

1986 The first computer virus, Brain, is allegedly written by two brothers in Pakistan.

1987 The Christmas tree worm paralyses the IBM worldwide network.

1988 The Internet worm spreads through the US DARPA internet.

1990 Mark Washburn writes 1260, the first “polymorphic” virus, which mutates (i.e. change its form) each time it infects.

1992 There is a worldwide panic about the Michelangelo virus, although very few computers are infected.

1994 Good Times, the first major virus hoax, appears.

1995 The first macro virus, Concept, appears. In the same year, Australian virus writers produce the first virus specifically written for Windows 95.

1998 CIH or Chernobyl becomes the first virus to paralyze computer hardware.

1999 Melissa, a virus that forwards itself by email, spreads worldwide. Bubbleboy, the first virus to infect a computer when email is viewed, appears.

2000 Love Bug becomes the most successful email virus yet. This first virus appears for the Palm operating system, although no users are infected.
Jen C (20)
83754 2002-09-27 10:46:00 Download and run the removal tool available Here ( securityresponse.symantec.com)

Note there are two variants KakWorm and KakWormB and there is a removal tool for each.
Jim B (153)
83755 2002-09-27 10:51:00 From Symantec website
Wscript.KakWorm is a worm. It spreads using Microsoft Outlook Express. The worm attaches itself to all outgoing messages using the Signature feature of Outlook Express. Signatures enable you to automatically append information at the end of all outgoing messages.

So it seems that your outgoing emails were infected, and though the last is 2001, when the infection occured (2000), it probably stayed there.
I can not work out why the virus has reactivated, unless Nortons was not active when one of the old emails was opened and triggered.
Nortons and most AV programs will not scan emails that are not in use - so a virus can sleep in the PC if it gets in when antivirus protection is off (to my knowledge) It is only when they are opened, that the AV protection is triggered as the virus drops its payload
If you open the emails one by one, then NAV should trigger on one of them - probably the earliest ones
Marty2001 (421)
83756 2002-09-27 10:52:00 <puts on surgical gloves and mask>

Should we strenuously avoid clicking on Susans link until we see she tests negative for the virus??

<sprays disinfectant at PC>

:D
godfather (25)
83757 2002-09-27 11:01:00 1982 Robo writes a true virus by modifying the operating system on an Apple II and becomes the first prefect at the school to go on detention after the virus wipes data on a teachers disk. robo (205)
83758 2002-09-27 11:08:00 Here is an excellant site which clearly explains the Kakworm virus and how to dispose of it members.tripod.com

Rolly
rolly (2044)
1 2