Monday, August 18, 2008

Zlob

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\euwoeu.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0fe36c74-667b-454b-828e-75e4e72cbef8}"="causes"

It also installs Toolbar, BHO, Antispycheck Rogue software...

SmitfraudFix removes the infection.