Registry Cleaner Geeks

May 22, 2009 10:03:15 PM

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

When the virus is executed, it creates one of the following files for every file it infects:

* %CurrentFolder%\[INFECTED FILE NAME].url
* %CurrentFolder%\[INFECTED FILE NAME].msi

It then infects executable files found on the compromised computer by encrypting and moving 32,768 bytes of the host executable data into a separate file with the name [INFECTED FILE NAME].url in the current directory. It then writes itself into the first 28,672 bytes of the host file.

When an infected file is executed, it looks for the following file:
%CurrentFolder%\[INFECTED FILE NAME].url

It then copies the current file [INFECTED FILE NAME].exe to [INFECTED FILE NAME].exe.lnk.

It reads the [INFECTED FILE NAME].url file and decodes the encrypted host file, writing it to [INFECTED FILE NAME].exe.lnk.

It then launches the file in an attempt to disguise itself.

It then connects to a remote host and once connected it attempts to download any of the following items:

* Additional configuration file
* Additional malware
* An updated version of itself

Note: The remote host may be the following domain:
easycf.51.net

FREE SCAN:

Please click here for manual removal instructions.