Adware.BeSys

[Brad]

Behavior
Adware.BeSys is an adware program that download the advertisement list and displays it.

Transmission
The Adware.BeSys installer must be executed.

technical details
File names: BESys.exe; bead.ini

When Adware.BeSys is executed, it performs the following actions:

   1. Adds the value:

      "BeSys" = "[path to the adware program]"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

   2. Attempts to download [http:/ /]liveupdate.myim.cn/[removed]/beh.ini as bead.ini in the same directory as the adware program. The file contains the URL list of pop-up ads.

   3. Displays pop-up ads.

REMOVAL INSTRUCTIONS
See: http://securityresponse.symantec.com/avcenter/venc/data/adware.besys.html

To delete the value from the registry
   1. Click Start > Run.

   2. Type regedit

      Then click OK.

   3. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

   4. In the right pane, delete the value:

      "BeSys" = "[path to the adware program]"

   5. Exit the Registry Editor.