Trojan.NSIS.StartPage_512e5f9150
UDS:DangerousObject.Multi.Generic (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.NSIS.StartPage.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 512e5f91509cf5b967f4405385b85d23
SHA1: f951976220f850f92b97659aa16e65ca7ca09e4a
SHA256: 05025a6ca49f59a066ae7aa807bea6b64cb6778d4e65909a9cc451bfa2d97b2b
SSDeep: 24576:4b5ft3QPz/myivTS2u5fYKjHeWBaNzjGaF5roJm/89IwcuvEP:yX3kuyirSXVDepNfGaF5roW8Bcuv4
Size: 1041948 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
365weatherIns_61.exe:516
tianqiUpdate.1001.exe:1060
pcWeather365.exe:260
weatherPng2Ico.exe:1288
mscorsvw.exe:1912
weatherService.exe:1808
The Trojan injects its code into the following process(es):
%original file name%.exe:1812
greendou.exe:1088
File activity
The process %original file name%.exe:1812 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\greendou\skin\Default\misc\24_go2.png (648 bytes)
%Program Files%\greendou\skin\Default\misc\24_go.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\open.ini (659 bytes)
%Program Files%\greendou\skin\Default\control\MenuItem_Hover.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (111108 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_new2.png (801 bytes)
%Program Files%\greendou\skin\Default\control\tab_inactive.png (281 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_stop2.png (1 bytes)
%Program Files%\greendou\profile\Defaults\searchkeys.ini (14 bytes)
%Program Files%\greendou\skin\Default\control\combo_dropdown_hover.png (774 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_home2.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_forward.png (947 bytes)
%Program Files%\greendou\skin\Default\control\combosearch_dropdown.png (794 bytes)
%Program Files%\greendou\skin\Default\control\win_close.png (362 bytes)
%Program Files%\greendou\skin\Default\control\Button_Hover.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_forward3.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_favorites2.png (696 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_refresh2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\xID.dll (3 bytes)
%Program Files%\greendou\profile\Template\start\images\logo.gif (3 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_history2.png (994 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_undo2.png (840 bytes)
%Program Files%\greendou\profile\Template\start\images\header_logo.gif (2 bytes)
%Program Files%\greendou\ico\taobao.ico (2104 bytes)
%Program Files%\greendou\skin\Default\shared\16_edit.png (646 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\Md5dll.dll (8 bytes)
%Program Files%\greendou\skin\Default\control\sidebar_tab_inactive.png (259 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_new.png (879 bytes)
%Program Files%\greendou\skin\Default\misc\16_folder_open.png (614 bytes)
%Program Files%\greendou\profile\Defaults\CommandBars.ini (1 bytes)
%Program Files%\greendou\skin\Default\control\Button_Checked.png (976 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_back2.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_refresh.png (1 bytes)
%Program Files%\greendou\profile\SearchEngine\google.ico (1 bytes)
%Program Files%\greendou\skin\Default\control\status_bar_bg.png (445 bytes)
%Program Files%\greendou\profile\SearchEngine\taobao.ico (1 bytes)
%Program Files%\greendou\profile\Defaults\last.ini (348 bytes)
%Program Files%\greendou\profile\SearchEngine\baidu.ico (2 bytes)
%Program Files%\greendou\profile\Template\start\images\logo2.gif (596 bytes)
%Program Files%\greendou\skin\Default\shared\16_new.png (650 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_history.png (847 bytes)
%Program Files%\greendou\skin\Default\misc\16_ad_hunter.png (716 bytes)
%Program Files%\greendou\skin\Default\misc\16_open_in_bg.png (507 bytes)
%Program Files%\greendou\skin\Default\control\tab_bg.png (314 bytes)
%Program Files%\greendou\skin\Default\control\tab_active.png (1 bytes)
%Program Files%\greendou\skin\Default\control\progress.png (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (48595 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_back.png (953 bytes)
%Program Files%\greendou\skin\Default\mskin.ini (10 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_new2.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_new3.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_search2.png (969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\System.dll (11 bytes)
%Program Files%\greendou\skin\Default\misc\16_open_in_new.png (548 bytes)
%Program Files%\greendou\skin\Default\control\tab_new_hover.png (346 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_favorites.png (700 bytes)
%Program Files%\greendou\skin\Default\control\tab_close_hover.png (2 bytes)
%Program Files%\greendou\skin\Default\control\tab_close.png (259 bytes)
%Program Files%\greendou\profile\Template\start\images\header_bg.gif (83 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\NSISdl.dll (14 bytes)
%Program Files%\greendou\skin\Default\control\tab_sidebar.png (321 bytes)
%Program Files%\greendou\skin\Default\control\tab_new.png (350 bytes)
%Program Files%\greendou\skin\Default\control\combo_hover.png (261 bytes)
%Program Files%\greendou\skin\Default\control\sidebar_tab_active.png (957 bytes)
%Program Files%\greendou\skin\Default\control\tab_hover.png (346 bytes)
%Program Files%\greendou\profile\SearchEngine\config.ini (226 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_page_zoom.png (733 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_undo.png (748 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_search.png (871 bytes)
%Program Files%\greendou\profile\Template\start\index.html (832 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_page_zoom2.png (724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\Inetc.dll (20 bytes)
%Program Files%\greendou\skin\Default\misc\16_website_info.png (1 bytes)
%Program Files%\greendou\skin\Default\misc\16_folder_closed.png (587 bytes)
%Program Files%\greendou\skin\Default\control\combo.png (260 bytes)
%Program Files%\greendou\skin\Default\control\win_maximum.png (275 bytes)
%Program Files%\greendou\skin\Default\control\mainframe.png (288 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_home.png (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (694 bytes)
%Program Files%\greendou\profile\Template\start\style.css (3 bytes)
%Program Files%\greendou\skin\Default\control\title_bg.png (655 bytes)
%Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (682 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_forward2.png (1 bytes)
%Program Files%\greendou\skin\Default\control\combo_dropdown.png (794 bytes)
%Program Files%\greendou\skin\Default\control\skin_selector.png (283 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_new.png (637 bytes)
%Program Files%\greendou\skin\Default\control\combosearch_dropdown_hover.png (774 bytes)
%Program Files%\greendou\skin\Default\control\tab_sidebar_hover.png (322 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_stop.png (1 bytes)
%Program Files%\greendou\skin\Default\control\win_restore.png (302 bytes)
%Program Files%\greendou\skin\Default\control\Button_Pressed.png (1 bytes)
%Program Files%\greendou\profile\Defaults\config.ini (902 bytes)
%Program Files%\greendou\skin\Default\control\win_minimize.png (202 bytes)
%Program Files%\greendou\skin\Default\misc\16_page.png (519 bytes)
%Program Files%\greendou\profile\Template\start\images\dian.gif (376 bytes)
%Program Files%\greendou\GreenDou.exe (27153 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_back3.png (1 bytes)
%Program Files%\greendou\profile\Template\start\left.html (1 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsq1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (0 bytes)
The process 365weatherIns_61.exe:516 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\pcWeather365\skins\default\btn_max.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\nsWindows.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\btn_complete.bmp (3616 bytes)
%Program Files%\pcWeather365\weatherService.exe (4992 bytes)
%Program Files%\pcWeather365\updateInfo\loading.gif (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\btn_next.bmp (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\cnzzonline.html (2 bytes)
%Program Files%\pcWeather365\skins\common\large\n99.png (784 bytes)
%Program Files%\pcWeather365\skins\default\bg_small.png (784 bytes)
%Program Files%\pcWeather365\skins\common\future\n99.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\System.dll (11 bytes)
%Program Files%\pcWeather365\updateInfo\AlreadyUpdate.db (1 bytes)
%Program Files%\pcWeather365\config.ini (321 bytes)
%Program Files%\pcWeather365\skins\common\kz.png (3 bytes)
%Program Files%\pcWeather365\skins\default\btn_close.jpg (3 bytes)
%Program Files%\pcWeather365\sqliteApi.dll (784 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\config.ini (321 bytes)
%Program Files%\pcWeather365\skins\default\bg_large.png (1856 bytes)
%Program Files%\pcWeather365\skins\default\btn_min.jpg (3 bytes)
%Program Files%\pcWeather365\weatherPng2Ico.exe (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\checkbox1.bmp (5 bytes)
%Program Files%\pcWeather365\weatherInfo\weatherInfo.db (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\newfeather2.jpg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\KillProcDLL.dll (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\pcWeather365\×ÀÃæÌìÆøÔ¤±¨.lnk (836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\loading1.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\loading2.bmp (456 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\updateInfo\AlreadyUpdate.db (1 bytes)
%Program Files%\pcWeather365\skins\default\btn_move.jpg (1 bytes)
%Program Files%\pcWeather365\sqlite3.dll (20416 bytes)
%Program Files%\pcWeather365\pmAqiFunction.exe (4992 bytes)
%Program Files%\pcWeather365\skins\default\btn_setting.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\newfeather3.jpg (784 bytes)
%Program Files%\pcWeather365\updateInfo\un_update.html (1 bytes)
%Program Files%\pcWeather365\skins\default\skin.xml (6 bytes)
%Program Files%\pcWeather365\tianqiUpdate.1001.exe (9320 bytes)
%Program Files%\pcWeather365\skins\common\topbar.png (3 bytes)
%Program Files%\pcWeather365\msweather.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\md5dll.dll (8 bytes)
%Program Files%\pcWeather365\updateInfo\update.html (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\pcWeather365\×ÀÃæÌìÆøÔ¤±¨Ã¶ÔØ.lnk (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\SkinBtn.dll (4 bytes)
%Program Files%\pcWeather365\skins\common\close.png (873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\checkbox2.bmp (5 bytes)
%Program Files%\pcWeather365\weather.db (6584 bytes)
%Program Files%\pcWeather365\uninst.exe (2149 bytes)
%Program Files%\pcWeather365\skins\common\err.png (784 bytes)
%Program Files%\pcWeather365\updateInfo\i.gif (170 bytes)
%Program Files%\pcWeather365\pm25Function.exe (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\newfeather1.jpg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\btn_close.bmp (2 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\weatherInfo\weatherInfo.db (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\ToggleImages.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\bg.bmp (18424 bytes)
%Program Files%\pcWeather365\pcWeather365.exe (25776 bytes)
%Program Files%\pcWeather365\skins\common\loading.png (3 bytes)
%Program Files%\pcWeather365\areacode.db (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cnzzonline_61[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso4.tmp (84154 bytes)
%Program Files%\pcWeather365\skins\common\min.png (440 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\All Users\Application Data\pcWeather365\updateInfo\AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz3.tmp (0 bytes)
The process tianqiUpdate.1001.exe:1060 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pngicoInfo[1].xml (332 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\weatherInfo\weatherInfo.db.!mv (576 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\pngicoInfo\pngicoInfo.db.!mv (332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\weatherInfo[1].xml (576 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pmAqiInfo[1].xml (305 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\pmAqiInfo\pmAqiInfo.db.!mv (305 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\config.ini (1132 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pm25Info[1].xml (586 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\pm25Info\pm25Info.db.!mv (586 bytes)
%Program Files%\pcWeather365\config.ini (188 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~DF22C7.tmp (0 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\weatherInfo\weatherInfo.db (0 bytes)
The process greendou.exe:1088 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388392091[1].jpg (3811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tool2[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tool3[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388107229[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tool9[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\h[1].js (381 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lemai[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\btnbg[1].gif (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388366402[1].jpg (1187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388391261[1].jpg (1267 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388391317[1].jpg (1727 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388132803[1].jpg (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388366290[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388132905[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u_13741[1].htm (26777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388132878[1].jpg (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jd[1].png (378 bytes)
%Program Files%\greendou\profile\Defaults\config.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tool4[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388107152[1].jpg (3644 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\h[2].js (656 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (497 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388366319[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388107177[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tool1[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388391341[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].php (1098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388132853[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388132828[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1387868883[1].jpg (2910 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hf_body_bg[1].png (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\db100x60[1].gif (1272 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.h1231[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388369593[1].jpg (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tool8[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388392061[1].jpg (3015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index_icon[1].png (2402 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388369510[1].jpg (2176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tianqi2345_2[1].htm (788 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sale5[1].png (353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lvdou.300duo[1].htm (352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388366349[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\baidu-form[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchbg[1].gif (344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tool6[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388391366[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dangdang10060[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388369554[1].jpg (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388107122[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tool7[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388391285[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@5w[2].txt (757 bytes)
%Program Files%\greendou\profile\Defaults\last.ini (2974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAUBMZED.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388107202[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b0[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (8676 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@5w[1].txt (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388366375[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1387530625[1].jpg (4359 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tmall[1].png (181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tool5[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\baidu[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sethome[1].png (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index_icon[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\123logo[1].gif (1272 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u_13741[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\h[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@5w[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418 (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@5w[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tianqi2345_2[1].htm (0 bytes)
The process pcWeather365.exe:260 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\15909623[1].js (25 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (145 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\config.ini (62 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3084 bytes)
%Program Files%\pcWeather365\weatherData.tmp (325 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icon_9[1].gif (893 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tongji[1].htm (657 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
The process mscorsvw.exe:1912 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (474 bytes)
Registry activity
The process %original file name%.exe:1812 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"Publisher" = "1k4567hyu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayName" = "Â̶¹ä¯ÀÀÆ÷ 1.0.0.0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 90 A6 B5 3C B5 AC DD 9C 50 B7 04 96 0E 1F 61"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The process 365weatherIns_61.exe:516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pcWeather365]
"UninstallString" = "%Program Files%\pcWeather365\uninst.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pcWeather365]
"DisplayIcon" = "%Program Files%\pcWeather365\pcWeather365.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pcWeather365.exe]
"appdata" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pcWeather365]
"URLInfoAbout" = "http://114tq.com/"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pcWeather365.exe]
"quick" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pcWeather365]
"Publisher" = "365ÆøÃó¹¤×÷ÊÒ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pcWeather365.exe]
"(Default)" = "%Program Files%\pcWeather365\pcWeather365.exe"
"desk" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%]
"pcWeather365/weatherService.exe" = "weatherService"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pcWeather365]
"DisplayName" = "pcWeather365 1.0.0.1001"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pcWeather365.exe]
"Index" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pcWeather365.exe]
"Mac" = "00-0C-29-7C-CD-1F"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 5C 6B 7D 6D 07 F1 C1 ED 7C B2 72 0B E9 3C C6"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pcWeather365.exe]
"menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pcWeather365]
"DisplayVersion" = "1.0.0.1001"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pcWeather365.exe]
"collection" = "%Documents and Settings%\%current user%\Favorites"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pcWeather365.exe]
"jieguo" = "mac=00-0C-29-7C-CD-1F&soft_id=33&tuiguang_id=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe&yanzheng=84c8b24c6597ce51c54789a9b4632126"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"pcWeather365" = "%Program Files%\pcWeather365\pcWeather365.exe /autorun"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process tianqiUpdate.1001.exe:1060 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\pcWeather365]
"weatherPng2Ico.exe" = "æ°”è±¡å›¾æ ‡è‡ªåŠ¨è½¬æ¢å¤„ç†æ¨¡å—"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 19 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 15 82 01 F1 3B DD 5A B9 A5 46 FF 44 F8 40 92"
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Cache" = "E3 04 00 00 02 00 00 00 A8 03 00 00 02 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process greendou.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32]
"(Default)" = "%Program Files%\Internet Explorer\IEXPLORE.EXE"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013123120140101]
"CacheLimit" = "8192"
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012013123120140101\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013123120140101]
"CacheOptions" = "11"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013123120140101]
"CacheRepair" = "0"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Disable Script Debugger" = "yes"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1244086619"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 9B A0 D9 35 80 37 79 83 09 7E 59 F8 04 41 04"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013123120140101]
"CachePrefix" = ":2013123120140101:"
[HKCU\Software\Gie]
"update2" = "2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "greendou.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@shell32.dll,-12693" = "Favorites"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041720130418]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
[HKLM\System\CurrentControlSet\Services\Tcpip\Performance]
"Error Count"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
The process pcWeather365.exe:260 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\pcWeather365]
"tianqiUpdate.1001.exe" = "å‡çº§æ›´æ–°æ ¸å¿ƒ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 1F 29 57 93 03 EF F6 C7 D5 DB 9A FB 24 50 D2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process weatherPng2Ico.exe:1288 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC B4 92 0F 1A 91 0A 9C B5 CB 60 42 14 72 19 74"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
The process weatherService.exe:1808 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF CF DC 19 DD DB F4 26 89 C7 7E 1E 78 49 D7 A8"
[HKCR\AppID\weatherService.EXE]
"AppID" = "{636DA746-D508-400B-86A0-AE7F3C4008F7}"
[HKCR\AppID\{636DA746-D508-400B-86A0-AE7F3C4008F7}]
"LocalService" = "weatherService"
"(Default)" = "weatherService"
The Trojan deletes the following value(s) in system registry:
[HKCR\AppID\{636DA746-D508-400B-86A0-AE7F3C4008F7}]
"LocalService"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://lm.beilequ.com/update/365/365weatherIns_61.rar (ET POLICY PE EXE or DLL Windows file download , Malicious) |  122.225.100.200 |
| hxxp://lvdou.300duo.com/favicon.ico |  223.255.145.200 |
| hxxp://lvdou.300duo.com/ | |
| hxxp://lm.beilequ.com/u_13741.html | |
| hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/1.0.0.1001/cnzzonline/cnzzonline_61.html | 122.225.104.211 |
| hxxp://sj88.www.web.glb0.ldcache.net/hezi/jm/setup_a7158.rar | |
| hxxp://lm.beilequ.com/theme/hao123v3_1/css/global.css | |
| hxxp://lm.beilequ.com/theme/hao123v3_1/images/hf_body_bg.png | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool1.png | |
| hxxp://lm.beilequ.com/theme/hao123v3_1/images/baidu-form.png | |
| hxxp://lm.beilequ.com/theme/hao123v3_1/images/btnbg.gif | |
| hxxp://lm.beilequ.com/data/html/tianqi2345_2.htm | |
| hxxp://lm.beilequ.com/images/db100x60.gif | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool2.png | |
| hxxp://lm.beilequ.com/images/dangdang10060.gif | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool3.png | |
| hxxp://lm.beilequ.com/theme/hao123v3_1/images/sethome.png | |
| hxxp://lm.beilequ.com/images/123logo.gif | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool4.png | |
| hxxp://lm.beilequ.com/static/images/s/baidu.gif | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool5.png | |
| hxxp://lm.beilequ.com/theme/hao123v3_1/images/index_icon.png | |
| hxxp://lm.beilequ.com/images/upload/1388392061.jpg | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool6.png | |
| hxxp://lm.beilequ.com/images/upload/1388392091.jpg | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool7.png | |
| hxxp://lm.beilequ.com/theme/hao123v3_1/images/searchbg.gif | |
| hxxp://weather51la.cnzz.uujzy.com/post/ | |
| hxxp://lm.beilequ.com/static/js/ajax.js | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool8.png | |
| hxxp://lm.beilequ.com/theme/hao123v3/images/tool9.png | |
| hxxp://lm.beilequ.com/static/images/index_icon.gif | |
| hxxp://lm.beilequ.com/weath5wtq.php?a=getWeather | |
| hxxp://lm.beilequ.com/images/tmall.png | |
| hxxp://lm.beilequ.com/images/jd.png | |
| hxxp://lm.beilequ.com/static/js/123tu5.js?haov3 | |
| hxxp://lm.beilequ.com/images/lemai.png | |
| hxxp://lm.beilequ.com/images/upload/1387530625.jpg | |
| hxxp://lm.beilequ.com/static/images/tianqi/b0.gif | |
| hxxp://lm.beilequ.com/images/upload/1388369510.jpg | |
| hxxp://c.split.cnzz.com/stat.php?id=5779743 | |
| hxxp://lm.beilequ.com/images/upload/1388369554.jpg | |
| hxxp://c.split.cnzz.com/core.php?web_id=5779743&t=z | |
| hxxp://z7.cnzz.com/stat.htm?id=5779743&r=http://lvdou.300duo.com/&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=1964241308-1388476823-http://lvdou.300duo.com/&showp=1024x768&st=0&sin=http://lvdou.300duo.com/&t=undefinedundefinedundefinedundefinedundefinedundefined&rnd=1666775669 | 42.156.140.20 |
| hxxp://lm.beilequ.com/images/upload/1388369593.jpg | |
| hxxp://lm.beilequ.com/c.js | |
| hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=2020052427 | |
| hxxp://lm.beilequ.com/images/upload/1387868883.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388391261.jpg | |
| hxxp://pcookie.split.cnzz.com/app.gif?&cna=mGdJC7/8/hoCAbhrJiYPa1Gu | |
| hxxp://lm.beilequ.com/images/upload/1388391285.jpg | |
| hxxp://hm.e.shifen.com/h.js?bf8aae25f2470e8119f2768f78a8d610 | |
| hxxp://lm.beilequ.com/images/upload/1388391317.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388391341.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388391366.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388366290.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388366319.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388366349.jpg | |
| hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1479581248&si=bf8aae25f2470e8119f2768f78a8d610&st=3&su=http://lvdou.300duo.com/&v=1.0.53&lv=1&tt=我的上网主页 | |
| hxxp://lm.beilequ.com/images/upload/1388366375.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388366402.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388132803.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388132828.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388132853.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388132878.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388132905.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388107122.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388107152.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388107177.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388107202.jpg | |
| hxxp://lm.beilequ.com/images/upload/1388107229.jpg | |
| hxxp://lm.beilequ.com/images/sale5.png | |
| hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/weatherPng/cnzz.html | |
| hxxp://tongji.uujzy.com/tongji.html?1.0.1001_id61_md1_os1 | 60.190.171.236 |
| hxxp://js.users.51.la/15909623.js | 117.21.191.223 |
| hxxp://icon.ajiang.net/icon_9.gif | 125.46.49.200 |
| hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/1.0.0.1001/weatherdata/_61/cnzz.html | |
| hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/1.0.0.1001/weatherdata/_61/weatherInfo.xml | |
| hxxp://int.dpool.sina.com.cn/iplookup | 123.125.29.252 |
| hxxp://int.dpool.sina.com.cn/iplookup/ | |
| hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/1.0.0.1001/weatherdata/_61/pmAqiInfo.xml | |
| hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/1.0.0.1001/weatherdata/_61/pm25Info.xml | |
| hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/1.0.0.1001/weatherdata/_61/pngicoInfo.xml | |
| hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/1.0.0.1001/weatherdata/_61/updateInfo.xml | |
| www.xzsky.com | 122.225.104.211 |
| web2.51.la | 222.89.188.9 |
| cnzz.mmstat.com | 42.121.149.44 |
| js.hao2266.com | 122.225.100.200 |
| pcookie.cnzz.com | 42.121.149.42 |
| weather.uujzy.com | 122.225.203.94 |
| s13.cnzz.com |  1.99.192.16 |
| c.cnzz.com | 42.120.219.6 |
| www.5w123.com | 122.225.100.200 |
| www.5w.com | 122.225.100.200 |
| www.sj88.com | 202.97.174.68 |
| hm.baidu.com | 61.135.185.140 |
| www.biso.cc |  67.198.240.190 |
| www.h1231.com | 122.225.100.200 |
| www.hao2266.com | 122.225.100.200 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
365weatherIns_61.exe:516
tianqiUpdate.1001.exe:1060
pcWeather365.exe:260
weatherPng2Ico.exe:1288
mscorsvw.exe:1912
weatherService.exe:1808 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\greendou\skin\Default\misc\24_go2.png (648 bytes)
%Program Files%\greendou\skin\Default\misc\24_go.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\open.ini (659 bytes)
%Program Files%\greendou\skin\Default\control\MenuItem_Hover.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (111108 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_new2.png (801 bytes)
%Program Files%\greendou\skin\Default\control\tab_inactive.png (281 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_stop2.png (1 bytes)
%Program Files%\greendou\profile\Defaults\searchkeys.ini (14 bytes)
%Program Files%\greendou\skin\Default\control\combo_dropdown_hover.png (774 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_home2.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_forward.png (947 bytes)
%Program Files%\greendou\skin\Default\control\combosearch_dropdown.png (794 bytes)
%Program Files%\greendou\skin\Default\control\win_close.png (362 bytes)
%Program Files%\greendou\skin\Default\control\Button_Hover.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_forward3.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_favorites2.png (696 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_refresh2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\xID.dll (3 bytes)
%Program Files%\greendou\profile\Template\start\images\logo.gif (3 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_history2.png (994 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_undo2.png (840 bytes)
%Program Files%\greendou\profile\Template\start\images\header_logo.gif (2 bytes)
%Program Files%\greendou\ico\taobao.ico (2104 bytes)
%Program Files%\greendou\skin\Default\shared\16_edit.png (646 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\Md5dll.dll (8 bytes)
%Program Files%\greendou\skin\Default\control\sidebar_tab_inactive.png (259 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_new.png (879 bytes)
%Program Files%\greendou\skin\Default\misc\16_folder_open.png (614 bytes)
%Program Files%\greendou\profile\Defaults\CommandBars.ini (1 bytes)
%Program Files%\greendou\skin\Default\control\Button_Checked.png (976 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_back2.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_refresh.png (1 bytes)
%Program Files%\greendou\profile\SearchEngine\google.ico (1 bytes)
%Program Files%\greendou\skin\Default\control\status_bar_bg.png (445 bytes)
%Program Files%\greendou\profile\SearchEngine\taobao.ico (1 bytes)
%Program Files%\greendou\profile\Defaults\last.ini (348 bytes)
%Program Files%\greendou\profile\SearchEngine\baidu.ico (2 bytes)
%Program Files%\greendou\profile\Template\start\images\logo2.gif (596 bytes)
%Program Files%\greendou\skin\Default\shared\16_new.png (650 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_history.png (847 bytes)
%Program Files%\greendou\skin\Default\misc\16_ad_hunter.png (716 bytes)
%Program Files%\greendou\skin\Default\misc\16_open_in_bg.png (507 bytes)
%Program Files%\greendou\skin\Default\control\tab_bg.png (314 bytes)
%Program Files%\greendou\skin\Default\control\tab_active.png (1 bytes)
%Program Files%\greendou\skin\Default\control\progress.png (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (48595 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_back.png (953 bytes)
%Program Files%\greendou\skin\Default\mskin.ini (10 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_new2.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_new3.png (1 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_search2.png (969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\System.dll (11 bytes)
%Program Files%\greendou\skin\Default\misc\16_open_in_new.png (548 bytes)
%Program Files%\greendou\skin\Default\control\tab_new_hover.png (346 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_favorites.png (700 bytes)
%Program Files%\greendou\skin\Default\control\tab_close_hover.png (2 bytes)
%Program Files%\greendou\skin\Default\control\tab_close.png (259 bytes)
%Program Files%\greendou\profile\Template\start\images\header_bg.gif (83 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\NSISdl.dll (14 bytes)
%Program Files%\greendou\skin\Default\control\tab_sidebar.png (321 bytes)
%Program Files%\greendou\skin\Default\control\tab_new.png (350 bytes)
%Program Files%\greendou\skin\Default\control\combo_hover.png (261 bytes)
%Program Files%\greendou\skin\Default\control\sidebar_tab_active.png (957 bytes)
%Program Files%\greendou\skin\Default\control\tab_hover.png (346 bytes)
%Program Files%\greendou\profile\SearchEngine\config.ini (226 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_page_zoom.png (733 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_undo.png (748 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_search.png (871 bytes)
%Program Files%\greendou\profile\Template\start\index.html (832 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_page_zoom2.png (724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp\Inetc.dll (20 bytes)
%Program Files%\greendou\skin\Default\misc\16_website_info.png (1 bytes)
%Program Files%\greendou\skin\Default\misc\16_folder_closed.png (587 bytes)
%Program Files%\greendou\skin\Default\control\combo.png (260 bytes)
%Program Files%\greendou\skin\Default\control\win_maximum.png (275 bytes)
%Program Files%\greendou\skin\Default\control\mainframe.png (288 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_home.png (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (694 bytes)
%Program Files%\greendou\profile\Template\start\style.css (3 bytes)
%Program Files%\greendou\skin\Default\control\title_bg.png (655 bytes)
%Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (682 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_forward2.png (1 bytes)
%Program Files%\greendou\skin\Default\control\combo_dropdown.png (794 bytes)
%Program Files%\greendou\skin\Default\control\skin_selector.png (283 bytes)
%Program Files%\greendou\skin\Default\toolbar\16_new.png (637 bytes)
%Program Files%\greendou\skin\Default\control\combosearch_dropdown_hover.png (774 bytes)
%Program Files%\greendou\skin\Default\control\tab_sidebar_hover.png (322 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_stop.png (1 bytes)
%Program Files%\greendou\skin\Default\control\win_restore.png (302 bytes)
%Program Files%\greendou\skin\Default\control\Button_Pressed.png (1 bytes)
%Program Files%\greendou\profile\Defaults\config.ini (902 bytes)
%Program Files%\greendou\skin\Default\control\win_minimize.png (202 bytes)
%Program Files%\greendou\skin\Default\misc\16_page.png (519 bytes)
%Program Files%\greendou\profile\Template\start\images\dian.gif (376 bytes)
%Program Files%\greendou\GreenDou.exe (27153 bytes)
%Program Files%\greendou\skin\Default\toolbar\24_back3.png (1 bytes)
%Program Files%\greendou\profile\Template\start\left.html (1 bytes)
%Program Files%\pcWeather365\skins\default\btn_max.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\nsWindows.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\btn_complete.bmp (3616 bytes)
%Program Files%\pcWeather365\weatherService.exe (4992 bytes)
%Program Files%\pcWeather365\updateInfo\loading.gif (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\btn_next.bmp (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\cnzzonline.html (2 bytes)
%Program Files%\pcWeather365\skins\common\large\n99.png (784 bytes)
%Program Files%\pcWeather365\skins\default\bg_small.png (784 bytes)
%Program Files%\pcWeather365\skins\common\future\n99.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\System.dll (11 bytes)
%Program Files%\pcWeather365\updateInfo\AlreadyUpdate.db (1 bytes)
%Program Files%\pcWeather365\config.ini (321 bytes)
%Program Files%\pcWeather365\skins\common\kz.png (3 bytes)
%Program Files%\pcWeather365\skins\default\btn_close.jpg (3 bytes)
%Program Files%\pcWeather365\sqliteApi.dll (784 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\config.ini (321 bytes)
%Program Files%\pcWeather365\skins\default\bg_large.png (1856 bytes)
%Program Files%\pcWeather365\skins\default\btn_min.jpg (3 bytes)
%Program Files%\pcWeather365\weatherPng2Ico.exe (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\checkbox1.bmp (5 bytes)
%Program Files%\pcWeather365\weatherInfo\weatherInfo.db (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\newfeather2.jpg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\KillProcDLL.dll (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\pcWeather365\×ÀÃæÌìÆøÔ¤±¨.lnk (836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\loading1.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\loading2.bmp (456 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\updateInfo\AlreadyUpdate.db (1 bytes)
%Program Files%\pcWeather365\skins\default\btn_move.jpg (1 bytes)
%Program Files%\pcWeather365\sqlite3.dll (20416 bytes)
%Program Files%\pcWeather365\pmAqiFunction.exe (4992 bytes)
%Program Files%\pcWeather365\skins\default\btn_setting.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\newfeather3.jpg (784 bytes)
%Program Files%\pcWeather365\updateInfo\un_update.html (1 bytes)
%Program Files%\pcWeather365\skins\default\skin.xml (6 bytes)
%Program Files%\pcWeather365\tianqiUpdate.1001.exe (9320 bytes)
%Program Files%\pcWeather365\skins\common\topbar.png (3 bytes)
%Program Files%\pcWeather365\msweather.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\md5dll.dll (8 bytes)
%Program Files%\pcWeather365\updateInfo\update.html (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\pcWeather365\×ÀÃæÌìÆøÔ¤±¨Ã¶ÔØ.lnk (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\SkinBtn.dll (4 bytes)
%Program Files%\pcWeather365\skins\common\close.png (873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\checkbox2.bmp (5 bytes)
%Program Files%\pcWeather365\weather.db (6584 bytes)
%Program Files%\pcWeather365\uninst.exe (2149 bytes)
%Program Files%\pcWeather365\skins\common\err.png (784 bytes)
%Program Files%\pcWeather365\updateInfo\i.gif (170 bytes)
%Program Files%\pcWeather365\pm25Function.exe (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\newfeather1.jpg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\btn_close.bmp (2 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\weatherInfo\weatherInfo.db (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\ToggleImages.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\bg.bmp (18424 bytes)
%Program Files%\pcWeather365\pcWeather365.exe (25776 bytes)
%Program Files%\pcWeather365\skins\common\loading.png (3 bytes)
%Program Files%\pcWeather365\areacode.db (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cnzzonline_61[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso4.tmp (84154 bytes)
%Program Files%\pcWeather365\skins\common\min.png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pngicoInfo[1].xml (332 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\weatherInfo\weatherInfo.db.!mv (576 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\pngicoInfo\pngicoInfo.db.!mv (332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\weatherInfo[1].xml (576 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pmAqiInfo[1].xml (305 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\pmAqiInfo\pmAqiInfo.db.!mv (305 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pm25Info[1].xml (586 bytes)
%Documents and Settings%\All Users\Application Data\pcWeather365\pm25Info\pm25Info.db.!mv (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388392091[1].jpg (3811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tool2[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tool3[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388107229[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tool9[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\h[1].js (381 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lemai[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\btnbg[1].gif (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388366402[1].jpg (1187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388391261[1].jpg (1267 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388391317[1].jpg (1727 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388132803[1].jpg (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388366290[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388132905[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u_13741[1].htm (26777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388132878[1].jpg (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jd[1].png (378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tool4[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388107152[1].jpg (3644 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\h[2].js (656 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (497 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388366319[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388107177[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tool1[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388391341[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].php (1098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388132853[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388132828[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1387868883[1].jpg (2910 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hf_body_bg[1].png (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\db100x60[1].gif (1272 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.h1231[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388369593[1].jpg (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tool8[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388392061[1].jpg (3015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index_icon[1].png (2402 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388369510[1].jpg (2176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tianqi2345_2[1].htm (788 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sale5[1].png (353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lvdou.300duo[1].htm (352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388366349[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\baidu-form[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchbg[1].gif (344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tool6[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388391366[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dangdang10060[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388369554[1].jpg (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1388107122[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tool7[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1388391285[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@5w[2].txt (757 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAUBMZED.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1388107202[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b0[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@5w[1].txt (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1388366375[1].jpg (1058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1387530625[1].jpg (4359 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tmall[1].png (181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tool5[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\baidu[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sethome[1].png (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index_icon[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\123logo[1].gif (1272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\15909623[1].js (25 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (145 bytes)
%Program Files%\pcWeather365\weatherData.tmp (325 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icon_9[1].gif (893 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tongji[1].htm (657 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (474 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"pcWeather365" = "%Program Files%\pcWeather365\pcWeather365.exe /autorun" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
