Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\~nsu.tmp\Au_.exe' _?=%TEMP%\
- '%WINDIR%live.scr' /S
- '%CommonProgramFiles%\ArSwp3.exe'
- '%TEMP%\uninst.exe'
Modifies file system :
Creates the following files:
- C:\Factory.dll
- C:\QQGameDl.exe
- %PROGRAM_FILES%\znabc\AruNYZ.pic
- %WINDIR%live.scr
- %WINDIR%\vbcfg.ini
- %TEMP%\nsw2.tmp\System.dll
- %CommonProgramFiles%\ArSwp3.exe
- %TEMP%\temp.ini
- %TEMP%\~nsu.tmp\Au_.exe
- %TEMP%\uninst.exe
Deletes the following files:
- %TEMP%\temp.ini
- %TEMP%\uninst.exe
- %TEMP%\nsw2.tmp\System.dll
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '????'
- ClassName: '' WindowName: 'ФЛРР'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Run'
