Do you think the following website is all sweetness and light?

.....well, now that you mention it....

....whoops. Still, it's worth noting that, as with so many of these infection files, you DO sometimes get a few chances to redeem yourself before everything goes pear shaped:

Mind you, this would be a pretty boring blog entry if we did the sensible thing and failed to run the executable, right? Run it, run it, I hear you cry.

Well, okay then, just for you I'll run it...this is what ends up in your System32 Folder:

One of the files made reference to IFRAMES inside the code - never a good sign:

The page mentioned wasn't available during testing, so it could have been trying to load pretty much anything at all, from dubious advert to rogue executable. Who knows. What we do know, is that when everything is done and dusted, you're left with references to Browser Helper Objects:

...Winsock Layer hijacks...

...and a rogue service:

....that's a lot of hoop jumping to monitor what websites you're visiting, but oh well.

YHGames - no fun, no games.