changed to 1. Both the background and screensaver are in the System32 folder, however the screensaver cannot be deleted. Windows Automatic Updates (and other web-based services) may also be disabled and it is not possible to turn them back on. Infected DLLs or DAT files (with randomized names such as "__c00369AB.dat" and "slmnvnk.dll") will be present in the Windows/System32 folder and references to the DLLs will be found in the user's start up (viewable in MSConfig), registry, and as browser add-ons in Internet Explorer. Vundo may attempt to prevent the user from removing it or otherwise impede its operation, such as by disabling the task manager, registry editor, and msconfig, thereby preventing the system from booting into safe mode. Some firewalls or antivirus software may also be disabled by Vundo leaving the system even more vulnerable. Especially, it disables Norton AntiVirus and in turn uses it to spread the infection. Norton will show prompts to enable phishing filter, all by itself. Upon pressing OK, it will try to connect to real-av.org and download more malware. Popular anti-malware programs such as Spybot – Search & Destroy or Malwarebytes may be deleted or immediately closed upon loading. Renaming the program executable can work around this. Malwarebytes's executable may be deleted as soon as it is installed (depending on the system's infection). Installing the program on another computer and copying the executable into the infected computer's Malwarebytes directory usually works too. Web access may also be negatively affected. Vundo may cause many websites to be inaccessible. Search engine links may be redirected to rogue security software sites, which can be avoided by copy and pasting addresses. MS Juan may cause webpages to fail to load after sessions of browsing and present a blank page in the browser instead of the webpage. When this happens any programs may also fail to start and it may become impossible to use windows shutdown. The hard drive may start to be constantly accessed by the winlogon.exe process, thus periodic freezes may be experienced. Display pop-ups and also is additionally efficient in injecting promotions into search results. Warnings about SuperMWindow not shutting down may occur. Explorer.exe may constantly crash resulting in an endless loop of crashing then restarting. Creates a virus critical driver in C:\Windows\system32\drivers (ati0dgxx.sys). The virus can "eat" away at available hard drive space; hard drive space can fluctuate as much as +3 to -3 Gb