I had the kak virus when it first came out.. i couldn't find it either its a
clever little swine.. One indication of this worm--though it does not occur
on all systems--is the message "Driver or memory error" that appears briefly
as Windows starts.
The best way to find it is check your autoexec.bat file.. kak adds a line
at the end of it that is uses to launch itself.. look for
4. Locate and delete the line that reads:
C:\Windows\Start Menu\Programs\StartUp\kak.hta
NOTE: Some variants of this worm insert one or both of the following lines
instead of or in addition to the previous text. If you see either of these
lines--or any line that refers to kak--then it should be deleted.
_at_echo off C:\Windows\Start Menu\Programs\StartUp\kak.hta
Del C:\Windows\Start Menu\Programs\StartUp\kak.hta
you should also check the register as kak infects that too. it adds the
following entry
cAg0u "C:\WINDOWS\SYSTEM\(name).hta"
You also need to search for any kak.* files on your hard drive..
Full instructions can be found at
http://service1.symantec.com/SUPPORT/nav.nsf/docid/2000020318071406
I cannot tell if you are still infected because your last mail was not HTML
it is carried in the signature..
Bob DeAngelis
Received on Thu Nov 30 2000 - 17:25:09 UTC