FAB AntiVirus Frequently asked questions (FAQ)
The WScript.KaK.Worm virus has now become the most widespread computer virus in the
world, and it's not hard to see why. We have compiled a
few answers to questions which we have been asked recently about the virus and our WScript.KaK.Worm removal program called FABav.
Q. After removing the virus, when I clicked on one of the previously
infected emails, I got a message box saying "An ActiveX Control on this
page is not safe. Your Current security settings prohibit running unsafe
controls on this page. As a result this page may not display as
intended" What does this mean?
A This occurs when you attempt to open an infected email and
the attached signature file (KaK virus) is attempting
to re-infected your system. As you have installed the eyedog
security patch the virus is unsuccessful and you are presented with this
warning message. By running a combination of our software
and the security patch you have removed the core components of
the virus and protected yourself from re-infection and removed the virus'
ability to infect others. However the KaK virus is still present
(as an attached signature) in the emails stored on your machine
(these would probably be within your inbox/sent & delete items
etc). If you attempted to foward these emails on to
others you would then run the risk of spreading the virus. Our software has not been designed to delete
infected emails as you may have sensitive or important
information contained within them and if lost may be a cause for
concern. It is perfectly safe and we
would recommend deleting these emails at your earliest
convenience. In the meantime your system is protected from
re-infection and the core components of the virus have been
neutralised, preventing its ability to infect others.
Q. I receive the message "FABAV(1).exe
file is linked to missing export shell
32.dll:SHGetSpecialFolderPathA." When trying to run your program or the
program will not run at all.
A. You are attempting to run the program on
another operating system other than Windows98 for which it is specifically
designed for. Unfortunately the only way you can rid yourself of
this virus is to remove it manually, instructions for which can be
found at the Symantec website at www.symantec.com
Q. I run Anti-Virus
software but I still caught this virus, how did this happen?
A. Some Anti-Virus scanners
will only scan email attachments and files located on your hard
disk. As this virus does not spread using an attachment and
uses a signature file instead your virus scanner failed to
detect it. However once you were infected the scanner would have
then detected it.
Q. Where can I get a good
Anti-Virus scanner?
A. If you are in the
located United Kingdom then you can purchase Norton Anti-Virus
directly from Amazon.co.uk.
Q. My scanner software will
not work after downloading and running FABav. Why is this?
A. Part of the process
when restoring your system requires our application to return your
AutoExec.bat back to its original state prior to contracting the
virus. If you have installed certain scanner software or any other
software that stores settings in the autoexec.bat then these would be lost
during the virus removal. Fortunately FABav creates a backup of
the infected AutoExec.bat prior restoration so you can use this to restore
scanner settings. To do this perform the following steps:
- Delete autoexec.bat (see warning below)
- Rename Autoexec.fab to Autoexec.bat
- Edit the newly created Autoexec.bat file and remove the two kak
entries.
- Start Sysedit the system file editor (click
start - run. Type sysedit and press OK)
- Choose the Autoexec.bat window
- Find and delete the entries -
- @echo off C:\Windows\Start
Menu\Programs\StartUp\kak.hta
Del C:\Windows\Start
Menu\Programs\StartUp\kak.hta
- Exit Sysedit and save yes when prompted to save
changes.
Your scanner or other software should work as itended.
Q. When I run FABav I
get the message "no virus present" yet other Anti-Virus software tell
me that I have this virus, why?
A. FABav was designed
to eliminate the effects of the WScript.KaK.Worm from one of our
customer's sites which had spread over their entire Network and was
causing havock. Since that time numerous variants of KaK have been
created by virus writers which bypass our detection
routines. As and when these new variants are identified we will
update FABav to deal with the new threat. If you suspect you have a
new variant, drop us a line at antivirus@fabit.com and we will
advise you on a course of action to remove the virus.
Q. How can I find out about a really
good Software Development company that specialises in creating great
Internet Applications and small business software?
A. Very simple, send an email to info@fabit.com or call 07050
645407/8 or click www.fabit.com
|