Quote from: Bitmong on June 09, 2013, 11:46:24 AM

The source file executable install itself under C:\Users\\GUCUE directory. This directory looks empty if the malware process is running and hiding the files. However, the contents listed earlier are still in that directory.

Actually the files are only marked as system / hidden, not hidden with any rootkit. It also installs a file C:\WINDOWS\SysWOW64\notepad.exe , which tries to run a .Net framework installer that is trying to install something to the system.

The file owner needs to be changed before that file can be deleted.