Read If U Have A Hotmail Account

[FinalFantasyFan2002]

Has anyone here been receiving emails later that are writing in Spanish or something and they all contain a attachment which is over 300k in size?
I have a lot recently and my m8s hae been receiving some sent from my address when i didnt even send any of these junk mails.
I think my computer is infected with a virus.
WORM_DANDI.A
help?
warning dont open emails that have attachements over 300k and are writing in spanish.
I emailed hotmail they told me that my account has not been logged on by anyone else apart form me so i think i got a virus.

[jerryctx]

More info on that worm and removal instructions here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.kitro.c.worm.html

BTW, anyone could be infected by this worm, not just Hotmail users.

[FinalFantasyFan2002]

thanks, i've been trying to find out how to get rid of this virus for AGES but no luck thanks
but i dont understand those intrustions too well, i dont think that is the voris i have
after typing in "regedit" in Run
I see the following in a list
HKEY_CLASSES_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA

and when i click on hkey_current_user as it tells me to all i c at the right panel is:
(Default) (value not set)
PerfectFit Logical ... ""*<>l"

so that is wot shows up on the right panel, nothing which i am meant to delete?

[downtime]

You have to click on the + in front of the HKEY_CURRENT_USER key, then click on the + in front of the Software key, and keep following the described path by clicking the + in front of the next described key until you reach the run key. Then look in the right hand pane for the described entries.
So click on the + in front of each of these to find the next.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

[FinalFantasyFan2002]

thanks
this is what i get one the right panel now:

(Default) (value not set)

IntelProcNumUtility "C:\Intel\Intel\PSNCU\CpuNumber.exe" /nosplash"

iparmor mini "C:\Program Files\lparmor 5.33.40\iparmor.exe"

Mirabilis ICQ "C:\Program Files\ICQ\NDetect.exe"

MSMSGS "C\Program Files\Messenger\msmsgs.exe" /backgrou...

i dont know which one to delete???

[markp62]

You need to click on the plus sign next to Hkey_Current_User, and you will see more keys expand out of it. If you going here: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, you would then click on the + next to Hkey_Current_User, + next to Software, the + for Microsoft, the + for Windows, the + for Current Version, then click Run. To the right you will see values, or maybe not. There will always be one named Default, usually saying "value not set".
The same applies for Hkey_Local_Machine.

Be careful what you delete. In regedit, there is no Undo and deleted items do not go to the Recycle Bin. They are gone.
It might be easier for you to type in msconfig in the Run window and look around in there.
Go here (http://housecall.antivirus.com) for a free online antivirus scan.

[FinalFantasyFan2002]

thanks for the replys, i'll go for the easier and safer way thanks

[FinalFantasyFan2002]

I've been trying to use the Online AV Scan but when it is downloading something at the start it downloads up to 95% all the time and then freezes :(

[markp62]

Disable the IParmer, ICQ and CpuNumber.exe at startup and then do the scan. I wonder what else you have going at startup.
Those are legitimate programs, BTW, not viruses.
That webpage from jerryctx tells you what to look for concerning the virus that you named.
Does "rundll32.exe shell32.dll,Control_RunDLL C:\WINDOWS\1708.cpl" or "PAV.EXE" ring a bell?