Discovered: April 30, 2003
Updated: May 02, 2003 6:12:59 PM
Systems Affected: Windows

W32.Jeefo is a memory resident virus that infects Windows 32-bit portable executable files.

Discovered: April 30, 2003
Updated: May 02, 2003 6:12:59 PM
Systems Affected: Windows

W32.Jeefo is a parasitic virus that infects 32-bit Windows portable executable files. When an infected executable is run on the system, the virus will create the following file with the System attribute set:
%Windir%\svchost.exe

If the operating system is Windows 9x based, the virus will create the following registry entry so that it is executed every time Windows starts:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\"PowerManager" = %WinDir%\SVCHOST.EXE

On Windows NT/2000/XP systems, the virus installs itself as a service with the following properties:
Name: Power Manager
Description: Manages the power save features of the computer
Startup Type: Automatic
Log On As: LocalSystem

Once the virus is memory resident, it periodically searches the system for portable executable files to infect.