Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '»ўІҐУ°КУ' = '%PROGRAM_FILES%\»ўІҐУ°КУ\09094.exe'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\»ўІҐУ°КУ\09094.exe
- %TEMP%\nsy3.tmp\ns4.tmp %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\dll.bat
Executes the following:
- <SYSTEM32>\regsvr32.exe QvodBand.dll -s
- <SYSTEM32>\cmd.exe /c "%PROGRAM_FILES%\»ўІҐУ°КУ\qvod\dll.bat"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\tabs_left.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\tabs_fill.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\tabs_mid.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\tabs_search_fill.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\tabs_right.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\search_icon.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\search_botton.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\stop.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\tab1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\tab.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\volume.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\topright1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\volumeb.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\volumep.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\top.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\tabs_search_left.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\topleft.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\topright.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\topleft1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\progress_point_a.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\progress.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\progress_point_b.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\reold.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\progress_thumb.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\play.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\pause.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\playlist_toolbar.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\processp.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\pre.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\scroll_limit.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\scroll_left.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\scroll_limit_h.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\scroll_up.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\scroll_right.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\right1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\right.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\scroll_back.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\scroll_down.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\scroll_back_h.bmp
- <SYSTEM32>\i.ico
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Tip\view.bmp
- <SYSTEM32>\s.ico
- %HOMEPATH%\Desktop\МФ±¦№єОп.url
- %HOMEPATH%\Desktop\ЙПНшµјєЅ.url
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Tip\QvodTips_.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Tip\QvodTips.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Tip\back.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Tip\maintext.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Tip\close.bmp
- %TEMP%\nsy3.tmp\KillProcDLL.dll
- %HOMEPATH%\Start Menu\»ўІҐУ°КУ.lnk
- %TEMP%\nsy3.tmp\rfshdktp.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\uninst.exe
- %HOMEPATH%\Start Menu\МФ±¦№єОп.url
- %HOMEPATH%\Start Menu\ЙПНшµјєЅ.url
- %HOMEPATH%\Start Menu\Programs\»ўІҐУ°КУ\»ўІҐУ°КУ.lnk
- %HOMEPATH%\Desktop\»ўІҐУ°КУ.lnk
- %HOMEPATH%\Start Menu\Programs\»ўІҐУ°КУ\Р¶ФШ»ўІҐУ°КУ.lnk
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\next.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\mute2.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\open.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\play.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\pause.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Mini.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Logo.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\back.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\mute.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\info.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\volumeb.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\volume.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\volumep.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Tip\QvodTip.exe
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Tip\PopMessage.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\processp.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\pre.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\progress.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\progressd.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\MiNi\progress_thumb.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\QvodInsert.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\QvodInit.exe
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\QvodPlayer.exe
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\QvodTerminal.exe
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\QvodPlayer.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Qvod.cfg
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\pncrt.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\QvodBand.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\QvodExtend.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\QvodCfg.ini
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\backmid.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\backleft.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\backright.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\bleft1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\bgline.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\dll.bat
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\ShareModule.dll
- %TEMP%\nsy3.tmp\nsExec.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\back.bmp
- %TEMP%\nsy3.tmp\ns4.tmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Codecs\atrc.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Codecs\asfsplliter.ax
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Codecs\cook.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Codecs\f4v.swf
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Codecs\drvc.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\09094.exe
- %TEMP%\nsd2.tmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\AddIn\VisLrc.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Codecs\RealMediaSplitter.ax
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Codecs\ColorFilter.ax
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Playlist\Mediacenter.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Playlist\Keywords.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Playlist\Playlist.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Playlist\Text.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Playlist\QvodSearch.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Lang\en_US.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Codecs\raac.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Lang\zh_TW.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Playlist\Channel.xml
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\NetAgent.dll
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\media_sham.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\media_search.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\media_sham_2.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\mediare.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\mediaeditdel.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\media_files.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\media_del.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\media_files_2.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\media_info.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\media_fill.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\mute2.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\mute.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\next.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\open.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\nowplay.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\mediatree.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\mediatolist.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\menu.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\mtk.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\min.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\full.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\close.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\icon.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\infofull.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\info.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\bottomleft.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\bottom.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\bottomright.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\caption.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\bright1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\lsearchb2.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\lsearchb1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\lsearchbg.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\max.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\lsearchbg1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\left1.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\left.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\listbutton.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\listsplit.bmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\Skin\Default\listbutton2.bmp
Deletes the following files:
- %TEMP%\nsy3.tmp\nsExec.dll
- %TEMP%\nsy3.tmp\rfshdktp.dll
- %TEMP%\nsy3.tmp\KillProcDLL.dll
- %TEMP%\nsy3.tmp\ns4.tmp
- %PROGRAM_FILES%\»ўІҐУ°КУ\qvod\dll.bat
Network activity:
Connects to:
- 'www.df###wedxcx.com':8916
- 'localhost':1035
UDP:
- DNS ASK www.df###wedxcx.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MDIClient' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'ToolBarWindow32' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
