Bismut.net

Filename: itunesff.exe
Command: C:WINDOWSsystem32itunesff.exe -go -c200 -w
Description: Identified by NOD32 as the Win32/Dialer.EB adult premium dialer.
File Location: %System%
Startup Type: This startup entry is started automatically from a Run, RunOnce, RunServices, or RunServicesOnce entry in the registry.
Note: %System% is a variable that refers to the Windows System folder. By default this is C:WindowsSystem for Windows 95/98/ME, C:WinntSystem32 for Windows NT/2000, or C:WindowsSystem32 for Windows XP.Removal Instructions:
1. Delete the following registry key:
[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
“itunesff”=”%System%itunesff.exe”
2. End the itunesff.exe process.
3. Delete the following files:
%System%itunesff.exe
%WinDir%internt.exe
4. Revert all dial-up connection parameters to their original values
5. Delete the shortcuts the Trojan created on the Desktop