[Witchdoctor]

yea this is nasty ..... you can find it and when you reboot it runs system restore and replaces it self .... won't let you turn it off, but it does appear to let you shut it off it still runs at start up ..... changed a lot of valeus in the boot sequence in the registry ... and the values are so close to what they are supposed to be you have have to be in that stuff everyday to see the subtile changes like \ instead of / that type stuff. It is by far the most devistating virus I have seen

reading more on this it seems they caught this dude .... 30 years in prison

should have been life