Virus ?

[gogreen1]

New with computers. Have a problem with a virus. (I think). Have Norton 5.3 running on my computer. Had Netscape 6.0 as my browser and uninstalled it. Installed IE-6. (Outlook Express). It works fine. I subscribed for Sysmantec's (free)security alert. It sends out alerts via e-mail about twice a week. Last night a new message came in with a few new viruses listed. I was asked if I wanted to run a virus scan. I did, and got the message: "You have the
Wscript.Kakworm. They say it is located in my C:\Program files\SBIS\Users\User1\Mail\Sent. I ran Norton av updates and scanned for viruses late last night and found no viruses, either in the files ALL, or in compressed files. So I am a little confused. Do I, or don't I have this worm? Sure would appreciate you imput here. Thanks.
OS 98 SE. HP 700MGhrtz. p3. 384MGRAM

------------------
Jim

[mjc]

It could have:

A) Last night when you were asked to run the scan, found and removed it then.

B) Since it was there when you ran the update it could have masked itself from being detected (some virii can play havoc with anti-virus programs/updates if they are on the system when you run the updates).

In either case, to feel more comfortable, try going to one of the online scans...like HouseCall (http://housecall.antivirus.com/pc_housecall/)

------------------
mjc
Links list:Computer Links (http://www.dreamwater.org/tech/mjc/index.htm)

Celts are the men that heaven made mad, For all their battles are merry and their songs are all sad.

[sea69]

what mjc said above!

the virus if you already have it prior to updating DAT from Norton can and probably HAS overwritten your anti-virus program or itself to something that Norton can not recognise.

do as instructed and in the meantime don't even OPEN your mail application (Outlook Express or whetever when online)- because this (if present) wants to copy all of the addresses in your address book and send itself to ALL of your CONTACTS.

!


and- I don't care what ANYONE says- this is a prime example of if you have "000" as an added address in your address book, this virus cannot send out to all and will let you know that it's there by trying to.


------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)

[This message has been edited by sea69 (edited 03-12-2002).]

[YODA74]

Sea I thought you already gave Dr.Bombay in Tex. an ear full on the "000" Hoax http://www.PCGuide.com/ubb/biggrin.gif We believe ya I use it and "xxx" at the end http://www.PCGuide.com/ubb/wink.gif
http://www.symantec.com/avcenter/venc/data/wscript.kakworm.html
three files this booger uses
.hta
.reg
.bat


------------------
Death has come to our windows.

-- Jeremiah 9:21
(undoubtedly a Biblical reference to a Microsoft product!)

YODA74@carolina.rr.com

[This message has been edited by YODA74 (edited 03-12-2002).]

[david eaton]

I think you might also like to look at http://www.antivirus.com/vinfo/virusencyclo/default2.asp?m=q&virus=kakworm&alt=kakworm. There are several variants, and this site give removal instructions.


David

------------------
Any system, however complicated, if looked at in exactly the right way, will become even more complicated.

[gogreen1]

Thanks MJC and Sea, I went to HouseCall downloaded their Scan/Remove application. It came back with (2) viruses: JOKE WINVOID.A and JOKE GESCHENK.A. It said to delete them both and I did. The Wscript.Kakworm wasn't found. One thing I thought was interesting, it said,"If HouseCall finds a virus on your PC, it means that your current antivirus solution is not working properly." One more question. Should I go ahead and get this worm patch? Thanks again, both of you for helping me. Jim

------------------
Jim