Your English is fine, don't worry about it at all. Thank you very much for your work on this. I only knew about the hosts file being changed and the mutex it creates. Because I checked it with Norman Sandbox, but I didn't know about the EXE's. I thought it was Delphi because anti-viruses detect this as Delf which is what they normally tag Delphi malware as.

Thank you again you done a great job.

How did you know how to do what you did though?