Trojan.Win32.Feliz or Feliz is a trojan that runs on Win32. This trojan is written in Delphi.
When run the trojan first outputs a dialog with a demon picture and a single button. When the button is clicked the trojan looks for the C:\Windows\ directory and when found it outputs this message.
At the same time the trojan deletes the following files:
C:\COMMAND.COM C:\WINDOWS\COMMAND\COMMAND.COM C:\WINDOWS\SYSTEM.DAT C:\WINDOWS\USER.DAT C:\WINDOWS\SYSTEM.INI C:\WINDOWS\WIN.INI C:\WINDOWS\SYSTEM.CB C:\WINDOWS\WIN.COM
After that, the trojan gains control of the user's operating system. At this time the operating system becomes unstable and it will no longer start after next computer reboot.
If theC:\Windows\ directory is not found by the trojan, it will output a number of message boxes and gain control of the operating system even without activating its payload.