"Cannot import" error message...

[rhaney]

Greetings. Every now and then, on a client machine running 98se, we receive this popup error message: "Cannot import C:\Windows\kak.reg:Error opening file. There may be a disk or file system error." Any thoughts? Thanks! rhaney@nscmail.com

[reghakr]

Now that's agood one!
You have the KAK virus. Here's what it is and how to remove it:

F-Secure Virus Descriptions

NAME: Kak
ALIAS: Wscript.KakWorm, KakWorm

Kak is a worm that - like BubbleBoy - embeds itself without any attachment to every e-mail sent from the infected system. For further information about BubbleBoy, see the description: http://www.F-Secure.com/v-descs/bubb-boy.htm

Kak is written in JavaScript and it works on both English and French versions of Windows 95/98 if Outlook Express 5.0 is installed. It does not work in a typical Windows NT installation.

The worm uses a known security vulnerability that is in Outlook Express. Once the user receives an infected e-mail message and opens or views the message in the preview pane, the worm creates a file "kak.hta" to the Windows Startup directory.

Next time the system is restarted, the worm activates. It replaces "c:\autoexec.bat" with a batch file that deletes the worm from the Startup directory. The original "autoexec.bat" is copied to "C:\AE.KAK".

Also, It modifies the message signature settings of Outlook Express 5.0 by replacing the current signature with an infected file, "C:\Windows\kak.htm".

Therefore every message sent with Outlook Express will contain the worm after this has been done.

Then it modifies the Windows registry in such a way that it will be executed in every system startup. The key it adds to the registry is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\cAg0u

The .hta file that the virus creates and executes in the future is saved to Windows System directory. On the first day of each month, if the number of hours is more than 17 (i.e. 6pm or later), the worm will show an alert box.

Then the worm shuts down Windows.

F-Secure Anti-Virus detects the worm. When the worm has been detected, the user should delete the following files, if they exist:

C:\Windows\kak.htm
C:\Windows\System\(filename).hta where (filename) is a variable, and it changes from one system
to another

C:\Windows\Start Menu\Programs\Startup\kak.hta
C:\Windows\Menu Demarrer\Programmes\Demarrage\kak.hta

The "autoexec.bat" file can be restored by renaming "C:\AE.KAK" to "C:\autoexec.bat".

Kak uses a known security hole in Microsoft Outlook Express to create the local HTA file.

If active scripting is disabled from Outlook Express, the worm will not work.

Microsoft has more information on this problem available at: http://www.microsoft.com/Security/Bulletins/MS99-032faq.asp

They also have a patch to fix this problem at: http://www.microsoft.com/security/Bulletins/ms99-032.asp

==============================================
A well-documented page is here:
http://www.datafellows.com/v-descs/kak.htm

If you're receiving "Can't import kak.reg" on startup, try this. To restore the EXE association, open Notepad and copy and paste the following between the lines and save the file as exefix.reg. Double-click on the file to merge the contents into the registry.

=========BEGIN CUT==================
REGEDIT4

[HKEY_CLASSES_ROOT\.exe]
"Content Type"="application/x-msdownload"
@="exefile"

[HKEY_CLASSES_ROOT\.exe\ShellEx]

[HKEY_CLASSES_ROOT\.exe\ShellEx\{00021500-0000-0000-C000-000000000046}]
@="{88C9E8DE-8D28-11D3-8F3C-00A0249EABF4}"

[HKEY_CLASSES_ROOT\exefile]
"EditFlags"=hex:d8,07,00,00
@="Application"

[HKEY_CLASSES_ROOT\exefile\shell]
@=""

[HKEY_CLASSES_ROOT\exefile\shell\open]
@=""
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHan dlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHan dlers\{86F19A00-42A0-1069-A2E9-08002B30309D}]
@=""

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"
============END CUT=====================

reghakr

[rhaney]

To reghakr: Thanks a million, man. I've read some of your helps previously, and have come to highly respect your knowledge. You go the extra mile- hope you live forever! ~Ralph :)