http://antivirus.about.com/library/weekly/aa081903c.htm?terms=winppr32.exe+ I think it is a feature of the sobig worm. SoBig.F installs drops the file winppr32.exe to the Windows directory and adds the following keys to Windows Registry: [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TrayX" = %windir%\winppr32.exe /sinc HTH M. Thakur ----- Original Message ----- From: "Jim Harris" <hhlake@xxxxxxxx> To: <24hoursupport@xxxxxxxxxxxxx> Sent: Sunday, September 07, 2003 6:17 PM Subject: [24hoursupport] Virus Scam? > > My sister sent the following letter. Seems like I heard something simular a year or two ago. I told her to delete the e-mail, any advice is appreciated...Jim Harris > > I had a virus alert in my e-mail that said i have a virus called winppr32.exe in my system ®istary keys. It said to open DOS comand promp windows(fromStart,Programs>Accessories) and enter the following commonds :cd"%windir%system"regsvr32/uBHO2.dll regsvr32/uMSNIE.dll then RestartWindows and I should be able to delete the BH02.DLL & MSNIE,DLL files in the system folder.(the system folder can be found in the windows folder:It is called System 32 in XP & just System in 95 & 98. Now I wonder who would send me such a report- I went to every thing Panda has & tried a few other free scans. Far as I can see there is no-such virus, but maybe you can tell me what would happen to a persons computer if they did what this report said to do. For a web-based membership management utility and information on list policies, please see http://nibec.com/24hoursupport/ To unsubscribe, send a blank email to 24hoursupport-request@xxxxxxxxxxxxx with "unsubscribe" (without quotes) in the subject.