When executed, the trojan displays a fake Blue Screen of Death screen. It is notable due to the different shade of blue, the different font, the word "Windows" is not highlighted white, and the word occurred is spelled as "occurend". Upon restart, the trojan had installed itself to the registry to run at startup, thus causing this BSoD on restart in a similar manner to Duksten and Annoyer. To remove this, the user should reboot to Safe Mode and delete its files and registry entry.
- Boot into Safe Mode
- Launch "regedit" in the "Run" app
- Navigate to the following registry:
- Find and delete the value in "_system"
- Delete the copy of the file in the Windows directory
- Upon restart, the system will be as normal, here you can delete the shortcut on the desktop.