Behavior Details

1. Dropped files:
setting_v2.dat
Under the folder
C:\Users\\AppData\Roaming\careueyes

2. Creates Registry:

Adds registry data
NzAwNWM0ZGQ5MzNmMjdmNjUyNTlmNjRhN2U4Nzc0OTY=

Under the key:
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533}\uuid

Adds registry data
256

Under the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\GdiICMGammaRange

Adds registry data
C:\Users\\AppData\Local\Temp\9eac81efddd4866a2807.dat.exe /tray

Under the key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\CareUEyes

Removal Instructions

1. Update the copy of K7 security to the latest version.
2. Scan the system completely and remove the detected files.
3. Open Windows registry editor.
4. Delete the registry data
NzAwNWM0ZGQ5MzNmMjdmNjUyNTlmNjRhN2U4Nzc0OTY=

Under the key:
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533}\uuid

5. Delete the registry data
256

Under the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\GdiICMGammaRange

6. Delete the registry data
C:\Users\\AppData\Local\Temp\9eac81efddd4866a2807.dat.exe /tray

Under the key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\CareUEyes
7. Close the Windows registry.
8. Restart the machine.