The executable radff96a.tmp.exe has been detected as malware by 2 anti-virus scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘svchost.exe’. While running, it connects to the Internet address advancedsearch.virginmedia.com on port 80 using the HTTP protocol.