scotty44

iTrader: (12)

Just to let you guys no that theres a big 1 going round @ the mo , iv had it send me tonight so have a few ppl i no it send a pif. file with the header "omg this is funny " , DONT OPEN IT IF YOU GET IT SENT , or it will send it to all you MSN contacts
Not to sure @ the mo how bad it is , but i got rid pritty easy , it save a file named "cute"

ATB guys
scotty

StickyMicky

its allready been through my msn list thanks to another SN user who passed it onto me

was going around amonth or so back IIRC

scotty44

iTrader: (12)

There is this invitation too ( a DOS based file )

DO NOT TRY AND MAKE THIS LINK WORK !!
omg this is funny! http:***//jose.rivera4 .home.att.net/cute.***pif

Humm not that funny eh ,, some ppl have f$$k all better do than to send crap out like this

Comper100

Just had this 4 times mate too.

Beware!

SiDHEaD

Apparently there's one you don't even have to open, accepting it allows it to attack your msn protocol and transfer itself... Someone on my list has it.. keeps trying to send to me..

The other user isn't "sending" it - they know nothing about it till someone tells them..

Nicks VR4

Some Antivirus Vendors have gone to Medium Alert on this now
Most are calling it Kelvir

Go check your AV for the lastest Signatures

Iwan

Any ideas on how to remove this from an infected computer?

Lots of PCs are infected at my work and our ITS team don't seem to have a fix. The removal instructions on Symantec's website aren't any good as the worm disables the Windows XP System Restore tab (My Computer - Properties - System Restore doesn't exist on infected computers!), and prevents you running Liveupdate or Norton Antivirus.

Any standalone removal tools available that I can download for my colleagues? They can't download anything from the Antivirus sites as it modifies the 'hosts' file to block them all out.

BTW I didn't click on the link, so am about the only person in my team with a uninfected PC.

JackClark

Ignore the system restore part and the manual removal instructions should still remove the worm. After it's gone then do the system restore part. It's to stop the scanner from thinking you have the worm when in fact it's contained withing system restore.

Iwan

Ah, cheers - all sorted now anyway. All seems to work fine when done in Safe Mode.