Symptoms

Removal instructions:

Analyzed By

Technical Description:

Upon execution the malware changes the attributes of the file to "Read Only" and "Hidden" . This way the user can't see it anymore. After it makes copies of itself into these locations : %system32%\.vbe , %windows%\.vbe [ the path are relative to the ones where the user has installed the operating system ]

Creates these registry keys :

1. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" with the value of the {Computer name} that leads to this file "%windows%system32\.vbe". This is done so the virus is executed at startup.
   
2. [HKEY_LOCAL_MACHINE\SOFTWARE\{Computer name}]
   "til"="UC" [looks like a signature of the virus]
   "tjs"="708"
   "djs"="{Date of Infection}"
   "ded"="0"
   "osw"="4"

It copies onto removable storages and executes itself trough an "autorun.inf" file.