Hello everyone, today we're taking a look at the Kakworm, which was noteable for it's unique way of spreading
which utilizes an exploit in Outlook Express.
Go ahead and run the worm...
(clicky clicky)
And this is what an e-mail would look like, it could be any e-mail, nothing fancy
But it's just-- we'll just go for an e-mail
And you can see, it aleardy dropped it's files to the "Startup" menu
And, what the worm does, is it replaces the default signature in Outlook Express with a specially crafted frame.
Now, this frame, when it is previewed or viewed in the e-mail window in Outlook express
will launch the worm's code,
and cause it to install into the system.
Now, other than spreading, it doesn't do much, and you probably would not notice it's on your system.
However, on the 1st of the month, after 6pm, from the 6pm to midnight, every time the computer boots up, the worm runs its payload,
which would get pretty annoying.
So, i'll go ahead and restart and let it...
boot up into the worm.
Might take a little bit...
Aaaaany time now.
Any time at all, Windows 98.
Whenever you're finished, go ahead and boot.
There we go.
Alright, so, whenever the computer is booted on
the 1st of the month
from 6 to midnight...
You will see this:
wait for it- there it is
You get this message box.
It's Driver Memory Error,
[reading on-screen text]
Press OK
You're probably wondering what that is...
And then
the computer shuts down.
Ahh, don't you just love that screen.
Now, as you might guess, every time
you boot up
this message box will appear again, and
sorry
the computer will shut down again.
I had to set the keyboard down there so I can use the mouse.
Come on, Windows 98...
I belive in you. (Me too!)
You and your abilities to be destroyed by worms (I thought of something different... but eh.)
Sure does take a while...
There we go.
Once again, we load up to the desktop...
And, once again, you get the message box.
So if you were trying to use your computer on the 1st of the month...
at 6pm, this would get pretty irritating, because it'd keep shutting down.
And...
Really, it's pretty easy to clean, just delete the worm's files from the WINDOWS directory...
And that's about it.
Oh, we have to also make sure not to preview any infected e-mails...
otherwise they will re-launch itself and re-infect your system.
So it can be actually pretty tricky to clean,
but as long as you're careful not to re-infect yourself and delete all of your e-mails out of your inbox,
you should be fine.
And that's about it for the Kakworm.
(subtitles by Delta04)