Tom,

The file had pps extension. I don't remember the name, it was something like tata_trat. My husband ran it, then immediately killed. For some evedences I assume, that the 'developer' was from Russsia. For instance, this letter was sent to ~30 people (most of them are friends on our friend, we know them too, but several are some strange people, and one entry was 'To Developers of MS Outlook Express' (in Russian)....

I didn't see changes in our system, but of course, I'm a little scared now.
I'll check all extensions, you mentioned.

Thanks a lot for your support and if you find some information, I would be really greatful.

>Nadya,
> The registry key you refer to should not be deleted rather the data in it. FWIW mine has "%1 %" refering to using the comand (the %1) and 1 parameter.
>I have had to write many scripts at work to cleanup virus remnants from registries. They are tricky at best, we usually gather the offending information by reading the virus itself and doing its opposite(open with like ultra edit 32 instead of open). We use the mcafee and ca sites to get specific info to remove from the registries as well. These worm virii are particularily pervasive into the system, and whacked my little fox pro career hard they attack the sct files. I can tell the author is a vbs'er or a js'er because they probably don't know we use the *.sct before there was a windows script.
> If you know the virus name I can go get the info and even devise a reverse for your registry(including backup), as a courtesy, as you have helped me here many times (with source of course).
> The .vxd file you look for normally is not in the windows directory unless win2k has changed that. They are normally buried under systems, and if you get a directory of that area by *.vxd and see many the same SIZE and time it is suspect. The same applies to .exe, .wsh, .jpg, .mpg, .js, etc.. those executable file names.
>
>Tom