|
Wscript.KakWorm is a worm. It
spreads using Microsoft Outlook Express. The worm attaches
itself to all outgoing messages using the Signature feature
of Outlook Express. Signatures enable you to automatically
append information at the end of all outgoing messages.
This worm uses three files to
deliver its payload. The file extensions are:
The message that contains this
worm is written in an HTML format that supports scripting.
It uses a security hole in Microsoft Outlook/Outlook Express
that is known as "Scriptlet TypeLib," and it places a shortcut
to an .hta file in the StartUp folder. The next time the computer
is restarted, the .hta file is run.
|
