Below are details about the MS Removal malware that masquerades as a fake antivirus scanner. The file name appears to be generated, but overall the infection appears to be very simple.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
vn: mKe08200gFhAp08200
vd: C:\Documents and Settings\All Users\Application Data\mKe08200gFhAp08200\mKe08200gFhAp08200.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
vn: C:\Documents and Settings\All Users\Application Data\mKe08200gFhAp08200\mKe08200gFhAp08200.exe
vd: mKe08200gFhAp08200
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
vn: Name
vd: mKe08200gFhAp08200.exe
[redirected link]“.
