Adware.BeSys

When Adware.BeSys is executed, it creates the following registry entry so that it runs every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"BeSys" = "[PATH TO THE ADWARE PROGRAM]"

The risk then attempts to download the file bead.ini in the same directory as the adware program from the following location:
[http://]liveupdate.myim.cn/be/beh[REMOVED]

Note: The file contains the URL list of pop-up ads.

It then displays the pop-up ads.

Summary