Virus the Sequel!

I contracted the WScript.KakWorm virus from a "friends" e-mail. I went to the Symantic site and downloaded and ran the fix "Fixkak.exe ". It removed the virus and restored the computer. In doing so it deletes, among other things, the subkey 00000000 in the registry entry:

HKEY_CURRENT_USER\Identiies\???\Software\Microsoft\Outlook Express\5.0\Signatures\00000000

This is the registry entry for the default signature for OE5.5.

When I replace the signature and make it the default it re-creates the above subkey.

I again run the Fixkak.exe repair utility and it again says my computer is infected, restores it and deletes the subkey, but on checking other indicators of the infection there are none. I have done this several times.

My thought on this is that the Fixkak.exe utility is picking up the newly created registry subkey and thinking the virus is present. This to me indicates a "false positive" and the virus is not really there.

I have also done numerous virus scans, from within Win98, from the Norton Rescue disks, and from Symantec's security website with negative results.

Any comments???

 

Agreed.