Install Kakworm security patch

Helpline Q&A Directory

A friend recently alerted me that an email I had sent to him contained a virus. McAfee identified two files infected with JS/Kak. McAfee couldn't clean them, so recommended deletion and replacement from the original Windows CD. I was unable to replace them, but everything seems to have worked well since then.

Today I once again updated the DAT files and ran another scan. This time it found one file infected with JS/Kak, the file being c:\Windows\Start Menu\Programs\Disabled StartUp items\kak.hta. Again McAfee was unable to clean the file, so it was deleted. Do I need to replace these files, or does the virus generate them? Are there further steps I should be taking to clean up my system?

The HTA and HTM files detected are generated by the virus, so they should simply be deleted - there is nothing to replace. McAfee should differentiate between files that are placed on the system by a virus and can simply be deleted, and infections that modify other files which must be cleaned or replaced. The message it displays has confused many people.

As the Kakworm infected your system you obviously haven't installed the security patch that prevents Kak and its ilk from spreading. Install the patch using Windows Update or by going to www.microsoft.com/technet/security/bulletin/ms99-032.asp.