How to get rid of WScript.KakWorm?

WScript.KakWorm is written in JavaScript. For spreading it uses MS Outlook Express. The worm does not attach itself to messages as regular worm viruses do, but embeds its body into message as a script program. The worm works under English and French Windows versions only. It does not work in case Windows is installed in directory other than "C:WINDOWS".

The worm is fully compatible with MS Outlook Express only. In MS Outlook the worm is activated and infects the system, but it can not spread itself further because it targets MS Outlook Express only to spread its copies. Under other email systems the worm functionality depends on that system features. While infecting the system the worm creates three additional files with its copy. First two of them are used to infect the system, the last one is used to spread worm code in infected emails:

1. KAK.HTA in Windows startup folder
2. random named .HTA file in Windows system folder
3. KAK.HTM file in Windows folder

Deleting:

If your PC is not infected with KakWorm you should do the following:

1. Temporarily disable your CyberScrub AntiVirus Monitor;
2. Delete the infected message(s) from all of your mailboxes manually using your mail program, but be warned DO NOT OPEN THIS MAIL AND DO NOT TURN THE PREVIEW PANE ON, this virus is embedded in message text so you'll be infected just after you open an infected message;
3. Compact all folders;
4. Enable CyberScrub AntiVirus Monitor again.

If your PC is already infected then you should do the following:

1. Turn the preview pane in your mail client and close your email client.
2. Delete from your registry "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun" key "cAg0u = "C:WINDOWSSYSTEM(name).hta", where the entry "(name)" is an 8 character name (for example 68DAEF80.HTA as it is at you friends PC).
3. Restart your PC.
4. Remove the following files (if exist):
   - KAK.HTA from C:Windows
   - KAK.HTM from C:WindowsSystem
   - (name).HTA from C:WindowsSystem , where (name) is an 8 character name
   - KAK.HTA from C:WindowsStart MenuProgramsStartup
5. Delete the default email signature.
6. Delete messages which are not needed and which may contain the embedded script (as it described above).