Technical Information
Malicious functions:
Creates and executes the following:
- '%WINDIR%\Web\MsRundll32.exe'
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im qq.exe
- '<SYSTEM32>\taskkill.exe' /f /im Rstray.exe
- '<SYSTEM32>\taskkill.exe' /f /im 360tray.exe
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\web\705.5475.bat
- '<SYSTEM32>\ping.exe' 127.1
- '<SYSTEM32>\attrib.exe' +s +h "%WINDIR%\web\MsRundll32.exe"
Terminates or attempts to terminate
the following user processes:
- 360tray.exe
Modifies file system :
Creates the following files:
- %WINDIR%\Web\MsRundll32.exe
- %WINDIR%\Web\705.5475.bat
Sets the 'hidden' attribute to the following files:
- %WINDIR%\Web\MsRundll32.exe
Deletes the following files:
- %TEMP%\~DF325C.tmp
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'QQ????'
- ClassName: '(null)' WindowName: 'QQ2009 ???'
