Never open an attachment from anyone unless you know what it is.

The attachment has a variety of names, and the worm adds ".pif" or ".scr" to the end of it to trick the email client into running it. I have Outlook configured to not run attachments, so I haven't been infected.

The worm changes the reply address of the email by prepending a '_' to it. This thwarts attempts to reply to it. I've been sending replies to infected users to warn them by removing the '_'.

Thanks, Brad and the rest, for the links and info.
God bless you all-------

------------------
"Steel is the real deal"

Get the Norton it reall works well..

------------------
My Web Page
Sierra S-12 9&7
Peavey-2000-PX-300

quote:

---

This particular attachment is a Program Information File (PIF) which is actually a type of virus/worm.

---

In the interest of accuracy, PIF files are not themselves viruses or worms but are Windows system files. Most recent viruses/worms hide as a system file. For example, the Badtrans worm disguises itself as either a .PIF or .SCR file.

Just tryin' to help

This was a couple of days ago, and I have not noticed any problems.

Is it lurching somewhere on my machine waiting to strike?

quote:

---

Does that mean the virus is harmless in my system?

---

No. You should remove this trojan from your system. It contains its own e-mail engine and has the potential to relay personal information and act as a back door to allow a cracker into your system.

If you've opened or previewed this e-mail it has done damage. The attachment was not blank. It has already made alterations to your system - you just didn't see them occur. In particular, it does two bad things:

1. In some instances it makes the following change to your Windows registry:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceKernel32 = kernel32.exe




2. It deposits a keystroke recorder, kdll.dll, into your system and sends stolen info (such as your passwords, credit card info, etc.) to an e-mail address of the trojan writer's choosing.

If you don't have an anti-virus or anti-trojan utility, search your system for the above items and manually delete them.

I've tried and tried to get off lists, contact the authorities at MSN, Hotmail, Yahoo, and everyone else, but they can't do anything about it either.

Chances are, the Sierra e-mail is just because they've got you on a mailing list somewhere. Perhaps they got the virus in their computer, and you got it as a result of being on that list. That's all I'd say happened.

quote:

---

I couldn't locate runoncekernel32. I did however find "Kernel32.exe"... Is it save to remove it completely?

---

Yes, if you look at the registry key, the actual file name is to the right of the equal sign: "Kernel32.exe". You should go ahead and remove it.

There are several variants of this worm, however, and there may still be some remnants left behind. To be certain it is completely removed from your system, you should use a good anti-virus or anti-trojan program.

quote:

---

Can the KDLL.DLL file be found using the "search" function in the "start/find" menu? Will it search the registry?

---

Yes, you can find the DLL, if it exists, using the normal search function. But it won't search the registry. To do that, you'll need to launch RegEdit (Start/Run/regedit) and then use the "Edit/Find" menu item. However...

I am very pleased.

Panda is another program that offers automated updates, but I have not played with it yet.

jdg

------------------
MSA D-10 w/Nashville 400
'63 Gibson Hummingbird
16/15c Hammered Dulcimer

quote:

---

Now I should delete the old file???? and make a new backup of the new registry???

---

Good idea on both counts. And you really should have one of the advanced registry editing programs on hand just in case you ever need to make further changes.