cute.pif - W32.Kelvir.A

How to Remove the MSN Messenger Virus cute.pif - W32.Kelvir.A

Once again another MSN Messenger Virus is spreading around the Internet. This time the virus sends the following message to all your contacts:

omg this is funny![Followed by a link to download the cute.pif from jose.rivera4.home.att.net]

The user then downloads the file which sends the link to all of their contacts and then downloads a W32.Spybot worm onto the infected machine.

If your are lucky enough the program will just run on your machine, send to your contacts and end without downloading the Worm as it did on the machines we tested cute.pif on.

The first thing you should do therefore is delete the downloaded cute.pif making sure you do not run it again! Then check to see if a Worm has been downloaded as well.

1. Press Ctrl+Alt+Delete and look for hotkeysvc. If it's there select it and press "End Task".
2. Use the Windows Find feature to look for a file called "hotkeysvc.exe". Which if their should be in the %System% directroy. If you find the file delete it.
3. Goto 'Start' then 'Run' and type 'msconfig'. A new window should appear.
4. Click on the tab at the top right that says 'Startup'.
5. Look for, and if it exists, unitick the box next to "hotkeysvc.exe" or simlar name.

The http://jose.rivera4.home.att.net/cute.pif has now been fully removed!