Trojan.NSIS.StartPage_1b0e05d38a
Trojan.Win32.Badur.glzv (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.Win32.Badur (A) (Emsisoft), Artemis!1B0E05D38A0D (McAfee), NSIS:Adware-MT [PUP] (Avast), Trojan.NSIS.StartPage.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, Trojan.Win32.Swrort.3.FD, VirTool.Win32.DelfInject.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan, PUP, VirTool, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 1b0e05d38a0d5f858a000c288a8497f0
SHA1: 826dd881071533bd9d7e744c1fed9aecaa568ea9
SHA256: 4e66dde6347cd404c8757b8d2dfdd12c7d27e0ac4c241ff45adac745a46d5731
SSDeep: 1536:kpgpHzb9dZVX9fHMvG0D3XJOR2emf26GLkqIzjbanyu3E6NO1uWFX:SgXdZt9P6D3XJE On5K hOZFX
Size: 75674 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
WeatherRadar.exe:1292
YYMusic.exe:1996
WeatherRadarUpdate.3001.exe:1704
365weatherIns_61.exe:1320
Reader_sl.exe:1064
wuauclt.exe:344
PM10Radar.exe:676
YYJia.exe:416
setup_3128.exe:1960
mscorsvw.exe:1920
WeatherRadarSVR.exe:576
jusched.exe:1056
The Trojan injects its code into the following process(es):
YYJia.exe:228
%original file name%.exe:1792
File activity
The process WeatherRadar.exe:1292 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (137 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (288 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DUVJ0OU0\tongji[1].htm (657 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\weatherData.tmp (364 bytes)
The process YYMusic.exe:1996 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\YYMusic\201425\SysConfig.ini (434 bytes)
%Documents and Settings%\%current user%\Favorites\ÌìÒþüÊÂÃø.url (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\a[1].htm (3 bytes)
%Program Files%\YYMusic\201425\Data\user2.ini (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\tj[1].ashx (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\ver[1].txt (36 bytes)
%Documents and Settings%\%current user%\Favorites\Ãâ·ÑÉÃÃøµ¼º½.url (71 bytes)
%Program Files%\YYMusic\201425\Data\client.ini (36 bytes)
%Program Files%\YYMusic\201425\Data\server.ini (1 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\a[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\tj[1].ashx (0 bytes)
The process WeatherRadarUpdate.3001.exe:1704 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM10Context\PM10Context.db.!mv (604 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (1192 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM25Context\PM25Context.db.!mv (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\369[1].ico (32738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\AQIContext[1].xml (332 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\AQIContext\AQIContext.db.!mv (332 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (200 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db.!mv (571 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DUVJ0OU0\PM10Context[1].xml (604 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\369.ico.!mv (32738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\056RGL6J\PM25Context[1].xml (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\WeatherContext[1].xml (571 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~DF84D7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\369[1].ico (0 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\369.ico (0 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db (0 bytes)
The process 365weatherIns_61.exe:1320 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\newfeather1.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_min.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqliteApi.dll (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\tips.ico (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\System.dll (11 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\n99.png (6 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_max.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (325 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøèöÔØ.lnk (911 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqlite3.dll (20416 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\large\n99.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_large.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_close.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\skin.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\loading1.bmp (456 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\err.png (784 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (325 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\close.png (873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\checkbox1.bmp (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\AQIRadar.exe (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\ToggleImages.html (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\min.png (440 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\uninst.exe (2691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsDialogs.dll (9 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_setting.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM25Radar.exe (11344 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\weather.db (6584 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\un_update.html (1 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\btn_complete.bmp (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\btn_close.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\newfeather3.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\i.gif (170 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\areacode.db (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\loading.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\update.html (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarSVR.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\loading2.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\inetc.dll (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\kz.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\cnzz_61[1].htm (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherContext\WeatherContext.db (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\SkinBtn.dll (4 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM10Radar.exe (9320 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\RadarMfc.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\cnzzonline.html (2 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\updateRecord.db (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\topbar.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\loading.gif (8 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarUpdate.3001.exe (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsWindows.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\KillProcDLL.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\btn_next.bmp (2392 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\updateRecord.db (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_move.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\checkbox2.bmp (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøè.lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\bg.bmp (18424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp (85185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\newfeather2.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_small.png (9 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp (0 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport (0 bytes)
The process wuauclt.exe:344 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (3576 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
The Trojan deletes the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)
The process PM10Radar.exe:676 makes changes in the file system.
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~DFE427.tmp (0 bytes)
The process YYJia.exe:228 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\OLDSet.Xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\DMSet.Xml (675 bytes)
The process setup_3128.exe:1960 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\YYMusic\201425\Skin\lista.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_003.bmp (560 bytes)
%Program Files%\YYMusic\201425\swresample-0.dll (3312 bytes)
%Program Files%\YYMusic\201425\Skin\playinginga.jpg (5 bytes)
%Program Files%\YYMusic\201425\Skin\font_forecolor.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_007.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionlogin.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\frmWindowLrcParent.xml (157 bytes)
%Program Files%\YYMusic\201425\Skin\btn-play.png (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\YYMusic.lnk (787 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_3.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\frmplaylist.xml (5 bytes)
%Program Files%\YYMusic\201425\Skin\btn-delete.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\LrcBk.png (7 bytes)
%Program Files%\YYMusic\201425\Skin\color_006highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\sound (2).jpg (1 bytes)
%Program Files%\YYMusic\201425\source.dll (6584 bytes)
%Program Files%\YYMusic\201425\Skin\SetTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmdownmenu.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\tooltipbk.png (319 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontopahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\like.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\random03hover.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok_blue.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_5.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\pl_color.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyricmute.png (1 bytes)
%Program Files%\YYMusic\201425\audio.dll (3616 bytes)
%Program Files%\YYMusic\201425\Skin\PlayProgressForeImage.png (142 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\ÅäÖù¤¾ß\öÔØYYMusic.lnk (789 bytes)
%Program Files%\YYMusic\201425\Skin\random.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\downda.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\mine.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_set.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingrandom.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_015.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_1.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmPopWnd.xml (354 bytes)
%Program Files%\YYMusic\201425\Skin\mini.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmConfig.xml (4 bytes)
%Program Files%\YYMusic\201425\Skin\pl_forward.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\WindowLrcbkIamge.png (732 bytes)
%Program Files%\YYMusic\201425\Skin\btn_close.png (2 bytes)
%Program Files%\YYMusic\201425\SysConfig.ini (253 bytes)
%Program Files%\YYMusic\201425\Skin\color_004.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\bg2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_5.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\list_item.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionclose.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\more.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmWindowLrc.xml (174 bytes)
%Program Files%\YYMusic\201425\Skin\bg_2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_3.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\icon.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\min.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\sound100.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmWebBrowser.xml (308 bytes)
%Program Files%\YYMusic\201425\Skin\color_008highlight.bmp (552 bytes)
%Program Files%\YYMusic\201425\Skin\list_scroll_bar.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn-next.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmLrcChild.xml (263 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionseta.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_1.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbig.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclikea2.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\lyrictoplay.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\button.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\playersidebg.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\tab_comm.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_fh.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmColor.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnmin.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\progress_fore.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\reflash.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice1000528.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnfeedback.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn_kw.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_red.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\prev.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_2.png (5 bytes)
%Program Files%\YYMusic\201425\YYJia.exe (21216 bytes)
%Program Files%\YYMusic\201425\Skin\color_001highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\BtnRightTop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\normalVolume.png (2 bytes)
%Program Files%\YYMusic\201425\favorfm.xml (66 bytes)
%Program Files%\YYMusic\201425\Skin\bk.png (3616 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdelete.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\Òôÿµ÷½Úµã.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_sc.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_2.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\loading04.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\border.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdeletea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmSystemMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\close.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_9k.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\frmlogin.xml (3 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_7.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\playinging.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\prevention.png (3 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_13766042.lrc (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionmina.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\320x225.png (784 bytes)
%Program Files%\YYMusic\201425\picture\baidu_e1fe9925bc315c60bbe955728cb1cb134954772a.jpg (784 bytes)
%Program Files%\YYMusic\201425\Unins.exe (9608 bytes)
%Program Files%\YYMusic\201425\Skin\headimg.png (784 bytes)
%Program Files%\YYMusic\201425\Skin\font_bkcolor.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\history.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\random02hover.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\input-password.png (1 bytes)
%Program Files%\YYMusic\201425\Data\server.ini (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_010.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\feedback.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\playerbg02.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_013.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_014.bmp (1 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_262581.lrc (993 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_6.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\pl_icon.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_play.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\list_pause.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\input-user.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\remembertt.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\125x125.jpg (784 bytes)
%Program Files%\YYMusic\201425\Skin\next.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-login2.png (6 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedback.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\DefaultUserImage.jpg (6 bytes)
%Program Files%\YYMusic\201425\Skin\pl_back.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_7.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnexit.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\astop.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\btn-pause.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\playingvoice.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\FrmSetWindowLrcFrame.xml (3 bytes)
%Program Files%\YYMusic\201425\Skin\update.xml (2 bytes)
%Program Files%\YYMusic\201425\channels.xml (784 bytes)
%Program Files%\YYMusic\201425\Skin\playerbg01.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_bd.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\exit.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnmini.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_pause.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionsetahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_002highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\pushedVolume.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-fav.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\downd.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random03a.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01hover.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\list_title_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_itself.png (1 bytes)
%Program Files%\YYMusic\201425\DuiLib.dll (16288 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedbacka.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_btn_on.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnexit - ¸±±¾.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\pl_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\BtnHidePlayList.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pop_bkimage.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\musiclibrary.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\SelectColor_SliderBar_Thumb.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\list_play.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01a.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontopa.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn-anonymity.png (8 bytes)
%Program Files%\YYMusic\201425\Skin\DownLoadProgressForeImage.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_007highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_whiter.png (318 bytes)
%Program Files%\YYMusic\201425\Skin\mainframeshadow.png (4992 bytes)
%Program Files%\YYMusic\201425\Skin\mini´°.png (1 bytes)
%Program Files%\YYMusic\201425\picture\baidu_c8ea15ce36d3d539f9c9305e3b87e950342ab0b2.jpg (784 bytes)
%Program Files%\YYMusic\201425\Skin\pl_vol.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bg3.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\dash.png (955 bytes)
%Program Files%\YYMusic\201425\Skin\LoginBk.png (3312 bytes)
%Program Files%\YYMusic\201425\Skin\list.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\hotkeytipbk.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random02.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\next0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\play0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_004highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\frmplayer.xml (10 bytes)
%Program Files%\YYMusic\201425\Data\setup.ini (111 bytes)
%Program Files%\YYMusic\201425\Skin\back.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\search.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\forgettt.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\playerlist.png (4 bytes)
%Program Files%\YYMusic\201425\PlayerUpdate.exe (5064 bytes)
%Program Files%\YYMusic\201425\Skin\voiceall0528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_btn_down.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_009.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclikea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\progresstooltipbk.png (1552 bytes)
%Program Files%\YYMusic\201425\Skin\home.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-login.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_4.png (5 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_13881991.lrc (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_016.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingplaying.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\list_scroll_bar2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionminahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_list_bk.png (1552 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbigahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok_red.png (2 bytes)
%Program Files%\YYMusic\201425\Data\client.ini (38 bytes)
%Program Files%\YYMusic\201425\Data\dh.ini (56 bytes)
%Program Files%\YYMusic\201425\Skin\pl_mutevol.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\color_005.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btntop.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_prev.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclike.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\MessageBox.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\max.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\loading03.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_011.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_006.bmp (560 bytes)
%Program Files%\YYMusic\201425\Skin\downdahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_big.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_008.bmp (556 bytes)
%Program Files%\YYMusic\201425\avcodec-54.dll (23936 bytes)
%Program Files%\YYMusic\201425\Skin\loading01.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_xm.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\listahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensioncloseahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\slider_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Data\version.ini (32 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedbackahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_feedback.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\LyricFrameVoice.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_012.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\minea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingpreva.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\sound.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmDropDownMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\power.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\menu.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\fbcaptionbk.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\progresstooltip.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\FrmMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmLrc.xml (7 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_4.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\random02a.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_005highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\random03.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\ÒôÿÌõ.png (1 bytes)
%Program Files%\YYMusic\201425\pthreadGC2.dll (3616 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbiga.png (1 bytes)
%Program Files%\YYMusic\201425\avutil-52.dll (5520 bytes)
%Program Files%\YYMusic\201425\Skin\color_bg.bmp (784 bytes)
%Program Files%\YYMusic\201425\Skin\playingnext.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\color_002.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\color_unsel.bmp (5 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionclosea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\play2.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\mineahover.png (1 bytes)
%Program Files%\YYMusic\201425\YYMusic.exe (32784 bytes)
%Program Files%\YYMusic\201425\avformat-54.dll (12536 bytes)
%Program Files%\YYMusic\201425\Skin\list_item_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_6.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\FrmHotKeyTip.xml (482 bytes)
%Program Files%\YYMusic\201425\Skin\pl_split.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_003highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\playingprev.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmProgressToolTip.xml (393 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\AutoRunTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_001.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\FrmFeedBack.xml (411 bytes)
%Program Files%\YYMusic\201425\Skin\lrclist.png (4 bytes)
%Program Files%\YYMusic\201425\avcore.dll (2392 bytes)
%Program Files%\YYMusic\201425\picture\baidu_c2cec3fdfc03924517c1df928694a4c27d1e2532.jpg (784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\¹Ù·½Ö÷Ò³.lnk (334 bytes)
%Program Files%\YYMusic\201425\Skin\random0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_close.png (1 bytes)
%Program Files%\YYMusic\201425\libav.dll (6360 bytes)
%Program Files%\YYMusic\201425\Skin\voice0a0528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionset.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_small.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\scrollbar.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\collection.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdeletea2.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\loading02.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_comm.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice00528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingrandoma.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_blue.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_res.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_next.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\steup.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_desktop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnsteup.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\btn_db.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\prev0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionmin.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\channel.png (3 bytes)
The process %original file name%.exe:1792 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DUVJ0OU0\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (108756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\av.ini (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_3128.exe (376233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (36537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\Md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\056RGL6J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\Inetc.dll (20 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsd1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp (0 bytes)
The process mscorsvw.exe:1920 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (270 bytes)
The process jusched.exe:1056 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\jusched.log (347 bytes)
Registry activity
The process WeatherRadar.exe:1292 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WeatherRadar\3.0.0.3001]
"WeatherRadarUpdate.3001.exe" = "天气通å‡çº§æ¨¡å—"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 10 01 C1 96 0B 92 63 A1 8D EF AA FD 99 4A B0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process YYMusic.exe:1996 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 4C 9D BE 73 35 D8 74 98 E6 93 AB 75 54 15 4D"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_News_201425" = "%Program Files%\YYMusic\201425\YYJia.exe -mini"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_201425" = "%Program Files%\YYMusic\201425\YYMusic.exe -mini"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process WeatherRadarUpdate.3001.exe:1704 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WeatherRadar\3.0.0.3001]
"PM10Radar.exe" = "PM10Radar"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 53 DC A3 96 A4 35 28 18 92 21 F5 B7 53 B8 A5"
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Cache" = "A8 03 00 00 02 00 00 00 E3 04 00 00 01 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process 365weatherIns_61.exe:1320 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"URLInfoAbout" = "http://114tq.com/"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"appdata" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"desk" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"quick" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayIcon" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"Index" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayName" = "ÃÔÄãÌìÆøè 3.0.0.3001"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"collection" = "%Documents and Settings%\%current user%\Favorites"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"jieguo" = "mac=00-0C-29-64-A0-20&soft_id=33&tuiguang_id=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe&yanzheng=fb815cd10206670e32ad5cf9d247badc"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"Publisher" = "ÌìÆø蹤×÷ÊÒ"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"Mac" = "00-0C-29-64-A0-20"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayVersion" = "3.0.0.3001"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 25 86 2F 08 7D C5 EB 0A 63 10 60 F2 45 F9 8B"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"(Default)" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WeatherRadar]
"3.0.0.3001/WeatherRadarSVR.exe" = "气象雷达"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"UninstallString" = "%Program Files%\WeatherRadar\3.0.0.3001\uninst.exe"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WeatherRadar" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe /autorun"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process Reader_sl.exe:1064 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process PM10Radar.exe:676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 0F 5A 62 09 E6 5B 5E BF 46 5F 54 8D FD 33 D7"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
The process YYJia.exe:416 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 6A 27 D6 19 1A 2F 98 9A 55 A4 E7 54 78 C2 15"
The process YYJia.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 19 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE AD E1 56 F9 AD B0 BC 8B 98 F4 67 BA 8F 8B 88"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process setup_3128.exe:1960 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\YYMusic]
"Rd" = "_201425"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayName" = "YYMusic"
"Publisher" = "YYMusic"
[HKLM\SOFTWARE\YyfmPlay]
"Rd" = "_201425"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayVersion" = "1.0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 61 D5 72 9A 00 90 08 49 2B 07 3E 09 E8 4B 55"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"UninstallString" = "%Program Files%\YYMusic\201425\Unins.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayIcon" = "%Program Files%\YYMusic\201425\Unins.exe"
The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YyfmPlay"
"BoxNews"
"YYMusic_News"
"YYMusic"
The process %original file name%.exe:1792 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"Publisher" = "haha30"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayName" = "Â̶¹ä¯ÀÀÆ÷ 1.0.0.0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 4D E0 30 08 89 8B EC 86 60 8B 83 53 86 54 87"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The process WeatherRadarSVR.exe:576 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 31 C2 62 64 24 39 C2 1C DE 94 55 71 4E 68 DF"
[HKCR\AppID\{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}]
"LocalService" = "WeatherRadarSVR"
"(Default)" = "WeatherRadarSVR"
[HKCR\AppID\WeatherRadarSVR.EXE]
"AppID" = "{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}"
The Trojan deletes the following value(s) in system registry:
[HKCR\AppID\{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}]
"LocalService"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/cnzz/cnzz_61.html |  122.225.104.211 |
| hxxp://down.yinyue.fm/open/setup_3128.txt (ET POLICY PE EXE or DLL Windows file download , Malicious) | 222.186.60.1 |
| hxxp://weather51la.cnzz.alivcd.com/post/ | |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/weatherPng/cnzz.html | |
| hxxp://tongji.uujzy.com/tongji.html?3.0.3001_id61_md1_os1 | 60.190.171.236 |
| hxxp://js.users.51.la/15909623.js | 113.107.42.34 |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/weatherdata/_61/cnzz.html | |
| hxxp://sj88.www.web.glb0.ldcache.net/hezi/jm/setup_a7158.rar | |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/weatherdata/cnzz.html | |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/weatherdata/WeatherContext.xml | |
| hxxp://int.dpool.sina.com.cn/iplookup (SURICATA STREAM TIMEWAIT ACK with wrong seq ) | 123.125.29.252 |
| hxxp://int.dpool.sina.com.cn/iplookup/ (SURICATA STREAM TIMEWAIT ACK with wrong seq ) | |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/weatherdata/AQIContext.xml | |
| hxxp://update.yinyue.fm/DM5/DMSet.Xml | 171.111.158.28 |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/weatherdata/PM25Context.xml | |
| www.sj88.com | 202.97.174.68 |
| www.xzsky.com | 122.225.104.211 |
| weather.uujzy.com | 122.225.203.94 |
| weather51la.cnzz.beilequ.com | 122.225.104.211 |
| weather51la.cnzz.uujzy.com | 122.225.104.211 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
WeatherRadar.exe:1292
YYMusic.exe:1996
WeatherRadarUpdate.3001.exe:1704
365weatherIns_61.exe:1320
wuauclt.exe:344
PM10Radar.exe:676
YYJia.exe:416
setup_3128.exe:1960
mscorsvw.exe:1920
WeatherRadarSVR.exe:576 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (137 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (288 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DUVJ0OU0\tongji[1].htm (657 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\weatherData.tmp (364 bytes)
%Program Files%\YYMusic\201425\SysConfig.ini (434 bytes)
%Documents and Settings%\%current user%\Favorites\ÌìÒþüÊÂÃø.url (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\a[1].htm (3 bytes)
%Program Files%\YYMusic\201425\Data\user2.ini (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\tj[1].ashx (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\ver[1].txt (36 bytes)
%Documents and Settings%\%current user%\Favorites\Ãâ·ÑÉÃÃøµ¼º½.url (71 bytes)
%Program Files%\YYMusic\201425\Data\client.ini (36 bytes)
%Program Files%\YYMusic\201425\Data\server.ini (1 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM10Context\PM10Context.db.!mv (604 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM25Context\PM25Context.db.!mv (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\369[1].ico (32738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\AQIContext[1].xml (332 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\AQIContext\AQIContext.db.!mv (332 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (200 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db.!mv (571 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DUVJ0OU0\PM10Context[1].xml (604 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\369.ico.!mv (32738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\056RGL6J\PM25Context[1].xml (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\WeatherContext[1].xml (571 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\newfeather1.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_min.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqliteApi.dll (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\tips.ico (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\System.dll (11 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\n99.png (6 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_max.jpg (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøèöÔØ.lnk (911 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqlite3.dll (20416 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\large\n99.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_large.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_close.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\skin.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\loading1.bmp (456 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\err.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\close.png (873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\checkbox1.bmp (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\AQIRadar.exe (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\ToggleImages.html (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\min.png (440 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\uninst.exe (2691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsDialogs.dll (9 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_setting.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM25Radar.exe (11344 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\weather.db (6584 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\un_update.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\btn_complete.bmp (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\btn_close.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\newfeather3.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\i.gif (170 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\areacode.db (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\loading.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\update.html (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarSVR.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\loading2.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\inetc.dll (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\kz.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\cnzz_61[1].htm (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherContext\WeatherContext.db (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\SkinBtn.dll (4 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM10Radar.exe (9320 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\RadarMfc.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\cnzzonline.html (2 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\updateRecord.db (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\topbar.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\loading.gif (8 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarUpdate.3001.exe (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\nsWindows.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\KillProcDLL.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\btn_next.bmp (2392 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\updateRecord.db (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_move.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\checkbox2.bmp (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøè.lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\bg.bmp (18424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp (85185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\newfeather2.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_small.png (9 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (3576 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\OLDSet.Xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\DMSet.Xml (675 bytes)
%Program Files%\YYMusic\201425\Skin\lista.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_003.bmp (560 bytes)
%Program Files%\YYMusic\201425\swresample-0.dll (3312 bytes)
%Program Files%\YYMusic\201425\Skin\playinginga.jpg (5 bytes)
%Program Files%\YYMusic\201425\Skin\font_forecolor.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_007.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionlogin.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\frmWindowLrcParent.xml (157 bytes)
%Program Files%\YYMusic\201425\Skin\btn-play.png (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\YYMusic.lnk (787 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_3.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\frmplaylist.xml (5 bytes)
%Program Files%\YYMusic\201425\Skin\btn-delete.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\LrcBk.png (7 bytes)
%Program Files%\YYMusic\201425\Skin\color_006highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\sound (2).jpg (1 bytes)
%Program Files%\YYMusic\201425\source.dll (6584 bytes)
%Program Files%\YYMusic\201425\Skin\SetTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmdownmenu.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\tooltipbk.png (319 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontopahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\like.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\random03hover.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok_blue.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_5.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\pl_color.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyricmute.png (1 bytes)
%Program Files%\YYMusic\201425\audio.dll (3616 bytes)
%Program Files%\YYMusic\201425\Skin\PlayProgressForeImage.png (142 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\ÅäÖù¤¾ß\öÔØYYMusic.lnk (789 bytes)
%Program Files%\YYMusic\201425\Skin\random.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\downda.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\mine.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_set.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingrandom.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_015.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_1.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmPopWnd.xml (354 bytes)
%Program Files%\YYMusic\201425\Skin\mini.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmConfig.xml (4 bytes)
%Program Files%\YYMusic\201425\Skin\pl_forward.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\WindowLrcbkIamge.png (732 bytes)
%Program Files%\YYMusic\201425\Skin\btn_close.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_004.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\bg2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_5.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\list_item.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionclose.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\more.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmWindowLrc.xml (174 bytes)
%Program Files%\YYMusic\201425\Skin\bg_2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_3.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\icon.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\min.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\sound100.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmWebBrowser.xml (308 bytes)
%Program Files%\YYMusic\201425\Skin\color_008highlight.bmp (552 bytes)
%Program Files%\YYMusic\201425\Skin\list_scroll_bar.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn-next.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmLrcChild.xml (263 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionseta.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_1.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbig.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclikea2.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\lyrictoplay.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\button.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\playersidebg.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\tab_comm.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_fh.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmColor.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnmin.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\progress_fore.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\reflash.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice1000528.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnfeedback.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn_kw.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_red.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\prev.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_2.png (5 bytes)
%Program Files%\YYMusic\201425\YYJia.exe (21216 bytes)
%Program Files%\YYMusic\201425\Skin\color_001highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\BtnRightTop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\normalVolume.png (2 bytes)
%Program Files%\YYMusic\201425\favorfm.xml (66 bytes)
%Program Files%\YYMusic\201425\Skin\bk.png (3616 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdelete.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\Òôÿµ÷½Úµã.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_sc.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_2.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\loading04.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\border.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdeletea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmSystemMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\close.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_9k.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\frmlogin.xml (3 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_7.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\playinging.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\prevention.png (3 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_13766042.lrc (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionmina.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\320x225.png (784 bytes)
%Program Files%\YYMusic\201425\picture\baidu_e1fe9925bc315c60bbe955728cb1cb134954772a.jpg (784 bytes)
%Program Files%\YYMusic\201425\Unins.exe (9608 bytes)
%Program Files%\YYMusic\201425\Skin\headimg.png (784 bytes)
%Program Files%\YYMusic\201425\Skin\font_bkcolor.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\history.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\random02hover.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\input-password.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_010.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\feedback.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\playerbg02.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_013.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_014.bmp (1 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_262581.lrc (993 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_6.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\pl_icon.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_play.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\list_pause.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\input-user.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\remembertt.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\125x125.jpg (784 bytes)
%Program Files%\YYMusic\201425\Skin\next.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-login2.png (6 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedback.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\DefaultUserImage.jpg (6 bytes)
%Program Files%\YYMusic\201425\Skin\pl_back.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_7.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnexit.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\astop.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\btn-pause.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\playingvoice.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\FrmSetWindowLrcFrame.xml (3 bytes)
%Program Files%\YYMusic\201425\Skin\update.xml (2 bytes)
%Program Files%\YYMusic\201425\channels.xml (784 bytes)
%Program Files%\YYMusic\201425\Skin\playerbg01.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_bd.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\exit.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnmini.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_pause.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionsetahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_002highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\pushedVolume.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-fav.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\downd.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random03a.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01hover.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\list_title_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_itself.png (1 bytes)
%Program Files%\YYMusic\201425\DuiLib.dll (16288 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedbacka.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_btn_on.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnexit - ¸±±¾.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\pl_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\BtnHidePlayList.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pop_bkimage.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\musiclibrary.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\SelectColor_SliderBar_Thumb.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\list_play.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01a.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontopa.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn-anonymity.png (8 bytes)
%Program Files%\YYMusic\201425\Skin\DownLoadProgressForeImage.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_007highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_whiter.png (318 bytes)
%Program Files%\YYMusic\201425\Skin\mainframeshadow.png (4992 bytes)
%Program Files%\YYMusic\201425\Skin\mini´°.png (1 bytes)
%Program Files%\YYMusic\201425\picture\baidu_c8ea15ce36d3d539f9c9305e3b87e950342ab0b2.jpg (784 bytes)
%Program Files%\YYMusic\201425\Skin\pl_vol.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bg3.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\dash.png (955 bytes)
%Program Files%\YYMusic\201425\Skin\LoginBk.png (3312 bytes)
%Program Files%\YYMusic\201425\Skin\list.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\hotkeytipbk.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random02.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\next0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\play0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_004highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\frmplayer.xml (10 bytes)
%Program Files%\YYMusic\201425\Data\setup.ini (111 bytes)
%Program Files%\YYMusic\201425\Skin\back.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\search.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\forgettt.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\playerlist.png (4 bytes)
%Program Files%\YYMusic\201425\PlayerUpdate.exe (5064 bytes)
%Program Files%\YYMusic\201425\Skin\voiceall0528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_btn_down.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_009.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclikea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\progresstooltipbk.png (1552 bytes)
%Program Files%\YYMusic\201425\Skin\home.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-login.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_4.png (5 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_13881991.lrc (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_016.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingplaying.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\list_scroll_bar2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionminahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_list_bk.png (1552 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbigahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok_red.png (2 bytes)
%Program Files%\YYMusic\201425\Data\dh.ini (56 bytes)
%Program Files%\YYMusic\201425\Skin\pl_mutevol.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\color_005.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btntop.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_prev.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclike.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\MessageBox.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\max.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\loading03.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_011.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_006.bmp (560 bytes)
%Program Files%\YYMusic\201425\Skin\downdahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_big.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_008.bmp (556 bytes)
%Program Files%\YYMusic\201425\avcodec-54.dll (23936 bytes)
%Program Files%\YYMusic\201425\Skin\loading01.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_xm.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\listahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensioncloseahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\slider_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Data\version.ini (32 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedbackahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_feedback.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\LyricFrameVoice.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_012.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\minea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingpreva.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\sound.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmDropDownMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\power.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\menu.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\fbcaptionbk.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\progresstooltip.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\FrmMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmLrc.xml (7 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_4.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\random02a.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_005highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\random03.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\ÒôÿÌõ.png (1 bytes)
%Program Files%\YYMusic\201425\pthreadGC2.dll (3616 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbiga.png (1 bytes)
%Program Files%\YYMusic\201425\avutil-52.dll (5520 bytes)
%Program Files%\YYMusic\201425\Skin\color_bg.bmp (784 bytes)
%Program Files%\YYMusic\201425\Skin\playingnext.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\color_002.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\color_unsel.bmp (5 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionclosea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\play2.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\mineahover.png (1 bytes)
%Program Files%\YYMusic\201425\YYMusic.exe (32784 bytes)
%Program Files%\YYMusic\201425\avformat-54.dll (12536 bytes)
%Program Files%\YYMusic\201425\Skin\list_item_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_6.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\FrmHotKeyTip.xml (482 bytes)
%Program Files%\YYMusic\201425\Skin\pl_split.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_003highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\playingprev.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmProgressToolTip.xml (393 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\AutoRunTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_001.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\FrmFeedBack.xml (411 bytes)
%Program Files%\YYMusic\201425\Skin\lrclist.png (4 bytes)
%Program Files%\YYMusic\201425\avcore.dll (2392 bytes)
%Program Files%\YYMusic\201425\picture\baidu_c2cec3fdfc03924517c1df928694a4c27d1e2532.jpg (784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\¹Ù·½Ö÷Ò³.lnk (334 bytes)
%Program Files%\YYMusic\201425\Skin\random0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_close.png (1 bytes)
%Program Files%\YYMusic\201425\libav.dll (6360 bytes)
%Program Files%\YYMusic\201425\Skin\voice0a0528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionset.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_small.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\scrollbar.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\collection.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdeletea2.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\loading02.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_comm.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice00528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingrandoma.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_blue.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_res.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_next.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\steup.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_desktop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnsteup.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\btn_db.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\prev0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionmin.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\channel.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DUVJ0OU0\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (108756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\av.ini (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3M1YZQ5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U9AR2TUX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_3128.exe (376233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (36537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\Md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\056RGL6J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\Inetc.dll (20 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jusched.log (347 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_News_201425" = "%Program Files%\YYMusic\201425\YYJia.exe -mini"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_201425" = "%Program Files%\YYMusic\201425\YYMusic.exe -mini"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WeatherRadar" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe /autorun" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
