Trojan.PWS.Qqrobber.985

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ProgramFiles(x86)%\systemfiles\system32.exe'

Modifies file system

Creates the following files

%ProgramFiles(x86)%\systemfiles\2.vbs
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\pause_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\pause_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\pause_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\mute_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\mute_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\mute_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\main_dialog.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\fullscreen_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\fullscreen_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\fullscreen_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\play_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\play_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\explayer_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\explayer_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\explayer_disabled.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\duration_slider_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\duration_slider_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\duration_slider_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\sopvod.exe
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\sopocx.ocx
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\config.xml
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\uusee\trafficlight.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\fullscreen_disabled.bmp
%HOMEPATH%\favorites\ВѕГёГ©В«ГЁГ«Г¬ГҐГІГµГЄГµГВјВЈВЎВЈВЎГ§Г«ГіГЈГІГµГЄГµВµГ¤Г±Г»В№ГўГ°Г Г©ГВЈВЎ.url
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\play_pressed.bmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\uninstall.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\Г¦ГґВ¶ВЇ\Г¬ГєГ±В¶qq.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\В№Г№В·ВЅГГёГµВѕ.lnk
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі.url
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\adv\default\index.html
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\adv\default\home.html
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\adv\default\thumbs.db
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\adv\sopadver.exe
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\sopcore.xml
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\volume_slider_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\volume_slider_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\volume_slider_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\unmute_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\unmute_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\unmute_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\thumbs.db
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\stop_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\stop_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\stop_hover.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\stop_disabled.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\sopstatus_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\soplogo_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\soplogo_normal.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\uusee\seeplayer.ocx
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\explayer_pressed.bmp
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\uusee\out_mmshttp.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\uusee\in_net.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\9ptv.exe
%HOMEPATH%\desktop\Г¬ГґВ±В¦ГГёВЅГ±ГЁГµВґГІГµГ»Г¬ГёВјГ»Г§Гё.lnk
%HOMEPATH%\favorites\ВїВґВїВґВµГ§ГЄГіВѕГ§ВЈВ¬Г—Г®Г°ГўГ—Г®ВєГЈВµГ¤ГўГ¬Г©В«ГЈГўВ·Г±ВµГ§ГЄГіВѕГ§ГГёГµВѕ.url
%HOMEPATH%\application data\microsoft\internet explorer\quick launch\internet exp1orer.url
%HOMEPATH%\favorites\Г—ВїГґВЅГ±Г§ГўГГ±В·ГГёГ©ГЇВ№ВєГ®ГЇГВјГЄГ©ВЈВ¬ГЄГ¶В»ГєВЈВ¬ГЄГЅГўГ«ВЈВ¬ВјГІВµГ§ВЈВ¬В»ВЇГ—В±Г¦В·ВЈВ¬Г¶ГіВ±ГВЈВ¬ГЄГ—ГЄГ®ВµГЁГґГєГЇГџГЇГєГЄГ».url
%HOMEPATH%\favorites\ВµВ±ВµВ±ГГё ВЁc ГЁВ«Г§ГІГ—Г®ВґГіВµГ¤Г¶Г°Г®Г¤ГГёГ©ГЇГЄГ©ВµГЄ&В№ВєГ®ГЇГ¶Г°Г°Г¤.url
%HOMEPATH%\favorites\ГІГ—ГЁВ¤ГГё - Г¦В·Г¶ГЄГГёВ№ВєВЈВ¬Г Г¶ГґГєГІГ—ГЁВ¤.url
%HOMEPATH%\favorites\Г¬ГґВ±В¦ГГё - Г¬ГґВЈВЎГ®ГІГЇВІВ»В¶.url
%HOMEPATH%\favorites\ВѕГҐГ¦В·ВёГџГ§ГҐГГёГўГ§ВµГ§ГЄГі.lnk
%HOMEPATH%\favorites\Г§В§Г§В§Г¬ГҐГіГЅГ¶В±ВІВҐ.lnk
%HOMEPATH%\desktop\ГЈГўВ·Г±ВµГ§ГіВ°.lnk
%HOMEPATH%\desktop\ВіВ¬ВјВ¶ВєГЈГГ¦Г°ВЎГіГ®ГЇВ·.lnk
%HOMEPATH%\desktop\Г§В§Г§В§Г¬ГҐГіГЅГ¶В±ВІВҐ.lnk
%HOMEPATH%\favorites\Г—Г®Г°ГўГўГ¬Г©В«ГЈГўВ·Г±ВµГ§ГіВ°ВЈВЎВёГџГ«Г№ВёГџГ§ГҐВЈВЎГ¬Г¬Г¬Г¬ВёГјГ°ГўВЈВЎВЈВЎВЈВЎ.url
%ProgramFiles(x86)%\systemfiles\taobao.ico
%ProgramFiles(x86)%\systemfiles\system32.exe
%ProgramFiles(x86)%\systemfiles\qq.ico
%ProgramFiles(x86)%\systemfiles\kusila.ico
%ProgramFiles(x86)%\systemfiles\game.ico
%ProgramFiles(x86)%\systemfiles\77zb.ico
%ProgramFiles(x86)%\systemfiles\9ptvs1.exe
%ProgramFiles(x86)%\systemfiles\9ptv.ico
%ProgramFiles(x86)%\systemfiles\3.vbs
%ProgramFiles(x86)%\systemfiles\3.bat
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\uninst.exe
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sopcast\skin\soplogo_hover.bmp
%HOMEPATH%\favorites\ВјВ«Г¦В·ГЈГ ГЈГ¤Г§ГҐВґВїГ°ВґГµГ¦ВЈВЎВЈВЎГЈГ ГВјВґГіВјВЇВєГЇВЈВЎ.url
%APPDATA%\microsoft\internet explorer\quick launch\Г¬ГґВ±В¦ГГёВЅГ±ГЁГµВґГІГµГ»Г¬ГёВјГ»Г§Гё.lnk
%HOMEPATH%\favorites\45575ГґГєГЇГџГ°ВЎГіГ®ГЇВ·ВЈВ¬Г—Г®ВєГЈГГ¦Г—Г®ВїГ¬ВµГ¤Г°ВЎГіГ®ГЇВ·.url
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sohu\mmcshell.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sina\В°ВІГ—В°.bat
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sina\zlib.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sina\liveupdate.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sina\downloader.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sina\clear.bat
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sina\uclivectrl.ocx
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sina\uclivecore.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\sina\state.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\cctv\cctvupdateinstall.dll
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\kernel\cctv\cctvplayer.ocx
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\readme.txt
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\info.ini
%HOMEPATH%\desktop\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі.lnk
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\chis.ini
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\languages\japanese.ini
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\languages\english.ini
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\languages\chinese gb.ini
%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\languages\chinese big5.ini
%APPDATA%\microsoft\internet explorer\quick launch\ГЈГўВ·Г±ВµГ§ГіВ°.lnk
%APPDATA%\microsoft\internet explorer\quick launch\Г§В§Г§В§Г¬ГҐГіГЅГ¶В±ВІВҐ.lnk
%APPDATA%\microsoft\internet explorer\quick launch\ВіВ¬ВјВ¶ВєГЈГГ¦Г°ВЎГіГ®ГЇВ·.lnk
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat

Network activity

Connects to

'ba##u.com':80
'so##.9ptv.com':80

TCP

HTTP GET requests

http://so##.9ptv.com/s1/

UDP

DNS ASK ba##u.com
DNS ASK so##.9ptv.com
DNS ASK ww###171.vip

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: '%HOMEPATH%\Desktop'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%ProgramFiles(x86)%\systemfiles\2.vbs"
'%WINDIR%\syswow64\wscript.exe' "%ProgramFiles(x86)%\systemfiles\3.vbs"
'%ProgramFiles(x86)%\systemfiles\9ptvs1.exe'
'%ProgramFiles(x86)%\ВѕГҐГ¦В·ВјВ«Г«Г№ГГёГўГ§ВµГ§ГіВ°ВµГ§ГЄГі\9ptv.exe'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\systemfiles\3.bat" "
'%WINDIR%\syswow64\reg.exe' del "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v
'%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "%ProgramFiles(x86)%\Internet Explorer\iexplore.exe http://www.626dh.cn/?cry6" /f
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\systemfiles\3.bat" "' (with hidden window)
'%WINDIR%\syswow64\wscript.exe' "%ProgramFiles(x86)%\systemfiles\3.vbs"' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial