New Version of WIN Antivirus (virus)

Brian Fine is reporting to us today that he has found a new virus. He says…

I'm calling it "Shelly"

Previous versions were able to change the shell executable key in the registry to point to a different infected application, effectively having you run the trojan instead of windows. Patched from microsquish stopped that. The latest version of this renames the shell key instead of altering it, it appends a 'Y' to the value (making it Shelly) then creates a new key pointing to an infected .exe in the Windows directory.

Thanks Brian for letting us know about this.