Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'QQPlugIn' = 'C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe'
- 'C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe'
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\del.bat" "
- <SYSTEM32>\del.bat
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\gb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\hsgb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\QQxlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\qqlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\JB.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zjtyjb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zcty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\yxjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zsjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ckxx.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ck.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zxjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zxh.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zsjlk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugHook.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugUpdate.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugIn.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ysjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ycty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\title.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ysjlk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zsjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zcty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\yxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yctys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\UnChk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\QQMini.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\ysjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yxjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\ysjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\Chk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\KillKIS.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\ClickLoadDrv.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\QQExit.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\log.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\lkjbx.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\gb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\fdj.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\qqlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ysjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ysg.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ycty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zsjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zsjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zctys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zxjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zxjwk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\gb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\dbtys.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\dbty.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\hsgb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\QQxlog.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\qqlog.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\JB.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zjtyjb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zcty.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\yxjdb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zsjdb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ckxx.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ck.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zxjdb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zxjwk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zxh.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zsjlk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugHook.dll
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugUpdate.exe
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugIn.dll
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ysjdb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ycty.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\title.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ysjlk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zsjdb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zcty.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\yxjwk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yctys.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\UnChk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\QQMini.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\ysjnk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yxjwk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yxjnk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\ysjwk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\Chk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\KillKIS.dll
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\ClickLoadDrv.dll
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\dbty.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\QQExit.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\log.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\dbtys.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\lkjbx.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\gb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\fdj.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\qqlog.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ysjdb.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ysg.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ycty.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zsjwk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zsjnk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zctys.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zxjnk.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\dbtys.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\dbty.png
- from C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp to C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zxjwk.png
- 'www.d9##.com':80
- DNS ASK www.d9##.com
- ClassName: '#32770 (Dialog)' WindowName: '??????????????'
- ClassName: 'Indicator' WindowName: ''