This old win32 worm is making a comeback and causing some concern with many users. When Windows starts, the user will receive a message about an infection of a Trojan win32 agent.

W32.Kitro.E.Worm is a worm that spreads by email and over social networks. The worm comes in a form of an attachment. This worm was first reported back in July 2002, but worms usually spawn other variants of the same.

Also Known As: W32/Duni.worm.c [McAfee], I-Worm.Kitro.d [AVP], Win32.Kitro.E [CA]

This worm also inserts a Visual Basic script on the computer.

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Threat Assessment according to Symantec:

Threat Containment: Easy
Removal: Moderate
Damage Level: Medium

To remove the value from the registry:

We strongly recommend that you back up the registry before you make any changes to it. Read the document How to make a backup of the Windows registry for instructions.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

4. In the right pane, look for the following (or similar) values, and delete any that you find:

KAZAAkCuF
PAV.EXE
Zonavirus
BNexe

5. Exit the Registry Editor.

For more instructions on how to remove this worm, please click here.