WinUp Remover (RBOT-AKB,WinUp.exe)

A worm that attempts to replicate across the network.

The virus puts files in your system directory:

• <System>\memsys.dll
• <System>\winup.exe
• <System>\xtemp1.exe
• <System>\xtemp2.exe

The registry entry bellow are created

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{990B770D-62AE-5421-DA6D-16033B76258C}

With the Value:

• (Default) = sys info
• stubpath = <System>\winup.exe