Trojan.Win32.Swrort_282d08bfd2
Trojan.Win32.Badur.ggrc (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.DownLoader11.3638 (DrWeb), Trojan.Win32.Badur (A) (Emsisoft), Artemis!282D08BFD20F (McAfee), Trojan.NSIS (Ikarus), NSIS:Adware-MT [PUP] (Avast), Trojan.NSIS.StartPage.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, Trojan.Win32.Swrort.3.FD, VirTool.Win32.DelfInject.FD, mzpefinder_pcap_file.YR, TrojanSwrort.YR (Lavasoft MAS)
Behaviour: Trojan, PUP, VirTool, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 282d08bfd20fc551e3a08ad95bc45140
SHA1: b32da22ef5e61cea909c5b6f07b22420e514bf80
SHA256: 846650b5173eaa10af01dfd3a5fdd23de7b15a936c1541835915ecce649845cc
SSDeep: 3072:SgXdZt9P6D3XJoOE/PzmqLueKXbNLWkofW6rtG6rd0xaftImP025TNZoSOn5KC/E:Se34OHzDlIRT6JG R1nPdjKSYUC/hkFX
Size: 166834 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
WeatherRadar.exe:348
365weatherIns_61.exe:740
YYMusic.exe:1072
setup_3128.exe:912
mscorsvw.exe:1912
WeatherRadarSVR.exe:1316
YYJia.exe:1364
WeatherRadarUpd:232
The Trojan injects its code into the following process(es):
%original file name%.exe:1376
setup_qd334.exe:644
YYJia.exe:228
File activity
The process WeatherRadar.exe:348 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\WeatherRadar\3.0.0.3001\weatherData.tmp (364 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tongji[1].htm (657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\15909623[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\icon_9[1].gif (893 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (135 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
The process %original file name%.exe:1376 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (125670 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_qd334.exe (17782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\Md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (14087 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_3128.exe (350906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\open.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\xID.dll (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\Inetc.dll (20 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb1.tmp (0 bytes)
The process 365weatherIns_61.exe:740 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_min.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqliteApi.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsDialogs.dll (9 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\tips.ico (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\md5dll.dll (8 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_max.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\bg.bmp (18424 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\loading1.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\btn_close.bmp (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøèöÔØ.lnk (911 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqlite3.dll (20416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_large.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_close.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ToggleImages.html (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\areacode.db (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cnzz_61[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\checkbox2.bmp (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\close.png (873 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\AQIRadar.exe (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\newfeather2.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\large\n99.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\min.png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\newfeather3.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\uninst.exe (2691 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\i.gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\btn_complete.bmp (2392 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM25Radar.exe (11344 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\weather.db (6584 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\un_update.html (1 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db (423 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\btn_next.bmp (2392 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\skin.xml (6 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\loading.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\update.html (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarSVR.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\cnzzonline.html (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM10Radar.exe (9320 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_move.jpg (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\kz.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe (19096 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_small.png (9 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherContext\WeatherContext.db (423 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\n99.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\checkbox1.bmp (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\RadarMfc.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsWindows.dll (10 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\err.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\topbar.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\loading.gif (8 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarUpdate.3001.exe (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr4.tmp (85185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\SkinBtn.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\newfeather1.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_setting.jpg (3 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\updateRecord.db (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\updateRecord.db (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\System.dll (11 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøè.lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\KillProcDLL.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\loading2.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\inetc.dll (784 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp (0 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport (0 bytes)
The process YYMusic.exe:1072 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\YYMusic\201425\SysConfig.ini (434 bytes)
%Documents and Settings%\%current user%\Favorites\ÌìÒþüÊÂÃø.url (74 bytes)
%Program Files%\YYMusic\201425\Data\user2.ini (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tj[1].ashx (3 bytes)
%Documents and Settings%\%current user%\Favorites\Ãâ·ÑÉÃÃøµ¼º½.url (71 bytes)
%Program Files%\YYMusic\201425\Data\client.ini (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\a[1].htm (3 bytes)
%Program Files%\YYMusic\201425\Data\server.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ver[1].txt (36 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\a[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tj[1].ashx (0 bytes)
The process setup_qd334.exe:644 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\metadl.dll (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi7.tmp (8533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\System.dll (11 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp (0 bytes)
The process setup_3128.exe:912 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\YYMusic\201425\Skin\lista.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_003.bmp (560 bytes)
%Program Files%\YYMusic\201425\swresample-0.dll (3312 bytes)
%Program Files%\YYMusic\201425\Skin\playinginga.jpg (5 bytes)
%Program Files%\YYMusic\201425\Skin\font_forecolor.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_007.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionlogin.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\frmWindowLrcParent.xml (157 bytes)
%Program Files%\YYMusic\201425\Skin\btn-play.png (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\YYMusic.lnk (787 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_3.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\frmplaylist.xml (5 bytes)
%Program Files%\YYMusic\201425\Skin\btn-delete.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\LrcBk.png (7 bytes)
%Program Files%\YYMusic\201425\Skin\color_006highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\sound (2).jpg (1 bytes)
%Program Files%\YYMusic\201425\source.dll (6584 bytes)
%Program Files%\YYMusic\201425\Skin\SetTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmdownmenu.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\tooltipbk.png (319 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontopahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\like.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\random03hover.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok_blue.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_5.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\pl_color.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyricmute.png (1 bytes)
%Program Files%\YYMusic\201425\audio.dll (3616 bytes)
%Program Files%\YYMusic\201425\Skin\PlayProgressForeImage.png (142 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\ÅäÖù¤¾ß\öÔØYYMusic.lnk (789 bytes)
%Program Files%\YYMusic\201425\Skin\random.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\downda.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\mine.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_set.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingrandom.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_015.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_1.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmPopWnd.xml (354 bytes)
%Program Files%\YYMusic\201425\Skin\mini.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmConfig.xml (4 bytes)
%Program Files%\YYMusic\201425\Skin\pl_forward.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\WindowLrcbkIamge.png (732 bytes)
%Program Files%\YYMusic\201425\Skin\btn_close.png (2 bytes)
%Program Files%\YYMusic\201425\SysConfig.ini (253 bytes)
%Program Files%\YYMusic\201425\Skin\color_004.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\bg2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_5.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\list_item.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionclose.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\more.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmWindowLrc.xml (174 bytes)
%Program Files%\YYMusic\201425\Skin\bg_2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_3.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\icon.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\min.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\sound100.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmWebBrowser.xml (308 bytes)
%Program Files%\YYMusic\201425\Skin\color_008highlight.bmp (552 bytes)
%Program Files%\YYMusic\201425\Skin\list_scroll_bar.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn-next.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmLrcChild.xml (263 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionseta.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_1.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbig.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclikea2.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\lyrictoplay.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\button.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\playersidebg.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\tab_comm.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_fh.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmColor.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnmin.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\progress_fore.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\reflash.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice1000528.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnfeedback.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn_kw.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_red.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\prev.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_2.png (5 bytes)
%Program Files%\YYMusic\201425\YYJia.exe (21216 bytes)
%Program Files%\YYMusic\201425\Skin\color_001highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\BtnRightTop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\normalVolume.png (2 bytes)
%Program Files%\YYMusic\201425\favorfm.xml (66 bytes)
%Program Files%\YYMusic\201425\Skin\bk.png (3616 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdelete.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\Òôÿµ÷½Úµã.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_sc.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_2.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\loading04.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\border.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdeletea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmSystemMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\close.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_9k.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\frmlogin.xml (3 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_7.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\playinging.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\prevention.png (3 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_13766042.lrc (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionmina.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\320x225.png (784 bytes)
%Program Files%\YYMusic\201425\picture\baidu_e1fe9925bc315c60bbe955728cb1cb134954772a.jpg (784 bytes)
%Program Files%\YYMusic\201425\Unins.exe (9608 bytes)
%Program Files%\YYMusic\201425\Skin\headimg.png (784 bytes)
%Program Files%\YYMusic\201425\Skin\font_bkcolor.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\history.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\random02hover.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\input-password.png (1 bytes)
%Program Files%\YYMusic\201425\Data\server.ini (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_010.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\feedback.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\playerbg02.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_013.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_014.bmp (1 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_262581.lrc (993 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_6.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\pl_icon.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_play.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\list_pause.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\input-user.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\remembertt.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\125x125.jpg (784 bytes)
%Program Files%\YYMusic\201425\Skin\next.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-login2.png (6 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedback.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\DefaultUserImage.jpg (6 bytes)
%Program Files%\YYMusic\201425\Skin\pl_back.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_7.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnexit.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\astop.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\btn-pause.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\playingvoice.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\FrmSetWindowLrcFrame.xml (3 bytes)
%Program Files%\YYMusic\201425\Skin\update.xml (2 bytes)
%Program Files%\YYMusic\201425\channels.xml (784 bytes)
%Program Files%\YYMusic\201425\Skin\playerbg01.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_bd.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\exit.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnmini.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_pause.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionsetahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_002highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\pushedVolume.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-fav.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\downd.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random03a.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01hover.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\list_title_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_itself.png (1 bytes)
%Program Files%\YYMusic\201425\DuiLib.dll (16288 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedbacka.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_btn_on.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnexit - ¸±±¾.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\pl_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\BtnHidePlayList.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pop_bkimage.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\musiclibrary.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\SelectColor_SliderBar_Thumb.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\list_play.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01a.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontopa.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn-anonymity.png (8 bytes)
%Program Files%\YYMusic\201425\Skin\DownLoadProgressForeImage.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_007highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_whiter.png (318 bytes)
%Program Files%\YYMusic\201425\Skin\mainframeshadow.png (4992 bytes)
%Program Files%\YYMusic\201425\Skin\mini´°.png (1 bytes)
%Program Files%\YYMusic\201425\picture\baidu_c8ea15ce36d3d539f9c9305e3b87e950342ab0b2.jpg (784 bytes)
%Program Files%\YYMusic\201425\Skin\pl_vol.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bg3.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\dash.png (955 bytes)
%Program Files%\YYMusic\201425\Skin\LoginBk.png (3312 bytes)
%Program Files%\YYMusic\201425\Skin\list.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\hotkeytipbk.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random02.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\next0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\play0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_004highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\frmplayer.xml (10 bytes)
%Program Files%\YYMusic\201425\Data\setup.ini (111 bytes)
%Program Files%\YYMusic\201425\Skin\back.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\search.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\forgettt.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\playerlist.png (4 bytes)
%Program Files%\YYMusic\201425\PlayerUpdate.exe (5064 bytes)
%Program Files%\YYMusic\201425\Skin\voiceall0528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_btn_down.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_009.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclikea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\progresstooltipbk.png (1552 bytes)
%Program Files%\YYMusic\201425\Skin\home.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-login.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_4.png (5 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_13881991.lrc (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_016.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingplaying.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\list_scroll_bar2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionminahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_list_bk.png (1552 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbigahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok_red.png (2 bytes)
%Program Files%\YYMusic\201425\Data\client.ini (38 bytes)
%Program Files%\YYMusic\201425\Data\dh.ini (56 bytes)
%Program Files%\YYMusic\201425\Skin\pl_mutevol.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\color_005.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btntop.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_prev.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclike.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\MessageBox.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\max.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\loading03.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_011.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_006.bmp (560 bytes)
%Program Files%\YYMusic\201425\Skin\downdahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_big.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_008.bmp (556 bytes)
%Program Files%\YYMusic\201425\avcodec-54.dll (23936 bytes)
%Program Files%\YYMusic\201425\Skin\loading01.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_xm.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\listahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensioncloseahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\slider_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Data\version.ini (32 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedbackahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_feedback.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\LyricFrameVoice.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_012.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\minea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingpreva.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\sound.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmDropDownMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\power.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\menu.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\fbcaptionbk.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\progresstooltip.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\FrmMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmLrc.xml (7 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_4.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\random02a.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_005highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\random03.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\ÒôÿÌõ.png (1 bytes)
%Program Files%\YYMusic\201425\pthreadGC2.dll (3616 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbiga.png (1 bytes)
%Program Files%\YYMusic\201425\avutil-52.dll (5520 bytes)
%Program Files%\YYMusic\201425\Skin\color_bg.bmp (784 bytes)
%Program Files%\YYMusic\201425\Skin\playingnext.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\color_002.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\color_unsel.bmp (5 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionclosea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\play2.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\mineahover.png (1 bytes)
%Program Files%\YYMusic\201425\YYMusic.exe (32784 bytes)
%Program Files%\YYMusic\201425\avformat-54.dll (12536 bytes)
%Program Files%\YYMusic\201425\Skin\list_item_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_6.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\FrmHotKeyTip.xml (482 bytes)
%Program Files%\YYMusic\201425\Skin\pl_split.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_003highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\playingprev.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmProgressToolTip.xml (393 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\AutoRunTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_001.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\FrmFeedBack.xml (411 bytes)
%Program Files%\YYMusic\201425\Skin\lrclist.png (4 bytes)
%Program Files%\YYMusic\201425\avcore.dll (2392 bytes)
%Program Files%\YYMusic\201425\picture\baidu_c2cec3fdfc03924517c1df928694a4c27d1e2532.jpg (784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\¹Ù·½Ö÷Ò³.lnk (334 bytes)
%Program Files%\YYMusic\201425\Skin\random0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_close.png (1 bytes)
%Program Files%\YYMusic\201425\libav.dll (6360 bytes)
%Program Files%\YYMusic\201425\Skin\voice0a0528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionset.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_small.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\scrollbar.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\collection.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdeletea2.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\loading02.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_comm.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice00528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingrandoma.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_blue.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_res.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_next.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\steup.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_desktop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnsteup.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\btn_db.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\prev0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionmin.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\channel.png (3 bytes)
The process mscorsvw.exe:1912 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (474 bytes)
The process YYJia.exe:228 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\OLDSet.Xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\DMSet.Xml (675 bytes)
The process WeatherRadarUpd:232 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM10Context\PM10Context.db.!mv (604 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (1192 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM25Context\PM25Context.db.!mv (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\PM10Context[1].xml (604 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\AQIContext\AQIContext.db.!mv (332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\PM25Context[1].xml (615 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (200 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db.!mv (571 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\369[1].ico (23474 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AQIContext[1].xml (332 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\369.ico.!mv (23474 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\WeatherContext[1].xml (571 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\369[1].ico (0 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db (0 bytes)
Registry activity
The process WeatherRadar.exe:348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WeatherRadar\3.0.0.3001]
"WeatherRadarUpdate.3001.exe" = "天气通å‡çº§æ¨¡å—"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 A2 A7 58 52 FF 80 E0 94 E5 CF 21 25 21 68 37"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:1376 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹]
"DisplayVersion" = "1.0.0.2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹]
"DisplayName" = "Â̶¹ 1.0.0.2"
"Publisher" = "aaa250"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 48 F3 EA 11 69 7E 03 32 EF F6 4E 8C 5F 04 83"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The process 365weatherIns_61.exe:740 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"URLInfoAbout" = "http://114tq.com/"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"appdata" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"desk" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"quick" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayIcon" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"Index" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayName" = "ÃÔÄãÌìÆøè 3.0.0.3001"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"collection" = "%Documents and Settings%\%current user%\Favorites"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"jieguo" = "mac=00-0C-29-7C-CD-1F&soft_id=33&tuiguang_id=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe&yanzheng=84c8b24c6597ce51c54789a9b4632126"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"Publisher" = "ÌìÆø蹤×÷ÊÒ"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"Mac" = "00-0C-29-7C-CD-1F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayVersion" = "3.0.0.3001"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 2D D3 59 AE 53 A1 C9 B9 74 67 96 CA 69 22 DC"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"(Default)" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WeatherRadar]
"3.0.0.3001/WeatherRadarSVR.exe" = "气象雷达"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"UninstallString" = "%Program Files%\WeatherRadar\3.0.0.3001\uninst.exe"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WeatherRadar" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe /autorun"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process YYMusic.exe:1072 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF 2B E9 B5 CD A7 90 2D 38 2C AD B3 11 86 B1 88"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_News_201425" = "%Program Files%\YYMusic\201425\YYJia.exe -mini"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_201425" = "%Program Files%\YYMusic\201425\YYMusic.exe -mini"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process setup_qd334.exe:644 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 72 34 89 A9 6E 3D CE 43 6D 70 12 A5 D2 28 15"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process setup_3128.exe:912 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\YYMusic]
"Rd" = "_201425"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayName" = "YYMusic"
"Publisher" = "YYMusic"
[HKLM\SOFTWARE\YyfmPlay]
"Rd" = "_201425"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayVersion" = "1.0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 4B 9E B4 51 58 95 9A B5 57 B2 9D 61 F2 21 EC"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"UninstallString" = "%Program Files%\YYMusic\201425\Unins.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayIcon" = "%Program Files%\YYMusic\201425\Unins.exe"
The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YyfmPlay"
"BoxNews"
"YYMusic_News"
"YYMusic"
The process WeatherRadarSVR.exe:1316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 EF 06 41 94 31 F7 70 36 BE 39 89 F6 D3 48 EE"
[HKCR\AppID\{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}]
"LocalService" = "WeatherRadarSVR"
"(Default)" = "WeatherRadarSVR"
[HKCR\AppID\WeatherRadarSVR.EXE]
"AppID" = "{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}"
The Trojan deletes the following value(s) in system registry:
[HKCR\AppID\{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}]
"LocalService"
The process YYJia.exe:1364 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 CC E3 A5 6B EE 93 F8 B4 9D 7E C8 5D DA 5B D5"
The process YYJia.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 19 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 43 46 7A CF 47 BB 93 ED 94 B0 7C E2 A8 4E D0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process WeatherRadarUpd:232 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 1B 88 D8 39 23 DD 26 FA E9 B4 A1 A2 A0 01 FE"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://down.yinyue.fm/open/setup_3128.txt (ET POLICY PE EXE or DLL Windows file download , Malicious) |  222.186.60.1 |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/cnzz/cnzz_61.html | 122.225.104.211 |
| hxxp://weather51la.cnzz.alivcd.com/post/ | |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/weatherPng/cnzz.html | |
| hxxp://tongji.uujzy.com/tongji.html?3.0.3001_id61_md1_os1 | 60.190.171.236 |
| hxxp://js.users.51.la/15909623.js | 117.21.191.223 |
| hxxp://icon.ajiang.net/icon_9.gif | 125.46.49.200 |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/weatherdata/_61/cnzz.html | |
| hxxp://sj88.www.web.glb0.ldcache.net/hezi/jm/setup_a7158.rar | |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/weatherdata/cnzz.html | |
| hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/3.0.0.3001/weatherdata/WeatherContext.xml | |
| hxxp://int.dpool.sina.com.cn/iplookup (SURICATA STREAM TIMEWAIT ACK with wrong seq ) | 123.125.29.252 |
| hxxp://update.yinyue.fm/DM5/DMSet.Xml | 171.111.158.28 |
| www.sj88.com | 202.97.174.68 |
| www.xzsky.com | 122.225.104.211 |
| web2.51.la | 222.89.188.140 |
| weather51la.cnzz.beilequ.com | 122.225.104.211 |
| weather.uujzy.com | 122.225.203.94 |
| weather51la.cnzz.uujzy.com | 122.225.104.211 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
WeatherRadar.exe:348
365weatherIns_61.exe:740
YYMusic.exe:1072
setup_3128.exe:912
mscorsvw.exe:1912
WeatherRadarSVR.exe:1316
YYJia.exe:1364
WeatherRadarUpd:232 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\WeatherRadar\3.0.0.3001\weatherData.tmp (364 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tongji[1].htm (657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\15909623[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\icon_9[1].gif (893 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (135 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (125670 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_qd334.exe (17782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\Md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (14087 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_3128.exe (350906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\open.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\xID.dll (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp\Inetc.dll (20 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_min.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqliteApi.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsDialogs.dll (9 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\tips.ico (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\md5dll.dll (8 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_max.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\bg.bmp (18424 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\loading1.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\btn_close.bmp (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøèöÔØ.lnk (911 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqlite3.dll (20416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_large.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_close.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ToggleImages.html (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\areacode.db (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cnzz_61[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\checkbox2.bmp (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\close.png (873 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\AQIRadar.exe (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\newfeather2.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\large\n99.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\min.png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\newfeather3.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\uninst.exe (2691 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\i.gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\btn_complete.bmp (2392 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM25Radar.exe (11344 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\weather.db (6584 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\un_update.html (1 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\btn_next.bmp (2392 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\skin.xml (6 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\loading.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\update.html (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarSVR.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\cnzzonline.html (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM10Radar.exe (9320 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_move.jpg (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\kz.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe (19096 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_small.png (9 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherContext\WeatherContext.db (423 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\n99.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\checkbox1.bmp (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\RadarMfc.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsWindows.dll (10 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\err.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\topbar.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\loading.gif (8 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarUpdate.3001.exe (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr4.tmp (85185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\SkinBtn.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\newfeather1.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_setting.jpg (3 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\updateRecord.db (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\updateRecord.db (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\System.dll (11 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøè.lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\KillProcDLL.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\loading2.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\inetc.dll (784 bytes)
%Program Files%\YYMusic\201425\SysConfig.ini (434 bytes)
%Documents and Settings%\%current user%\Favorites\ÌìÒþüÊÂÃø.url (74 bytes)
%Program Files%\YYMusic\201425\Data\user2.ini (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tj[1].ashx (3 bytes)
%Documents and Settings%\%current user%\Favorites\Ãâ·ÑÉÃÃøµ¼º½.url (71 bytes)
%Program Files%\YYMusic\201425\Data\client.ini (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\a[1].htm (3 bytes)
%Program Files%\YYMusic\201425\Data\server.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ver[1].txt (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\metadl.dll (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi7.tmp (8533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\System.dll (11 bytes)
%Program Files%\YYMusic\201425\Skin\lista.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_003.bmp (560 bytes)
%Program Files%\YYMusic\201425\swresample-0.dll (3312 bytes)
%Program Files%\YYMusic\201425\Skin\playinginga.jpg (5 bytes)
%Program Files%\YYMusic\201425\Skin\font_forecolor.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_007.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionlogin.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\frmWindowLrcParent.xml (157 bytes)
%Program Files%\YYMusic\201425\Skin\btn-play.png (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\YYMusic.lnk (787 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_3.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\frmplaylist.xml (5 bytes)
%Program Files%\YYMusic\201425\Skin\btn-delete.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\LrcBk.png (7 bytes)
%Program Files%\YYMusic\201425\Skin\color_006highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\sound (2).jpg (1 bytes)
%Program Files%\YYMusic\201425\source.dll (6584 bytes)
%Program Files%\YYMusic\201425\Skin\SetTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmdownmenu.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\tooltipbk.png (319 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontopahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\like.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\random03hover.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok_blue.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_5.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\pl_color.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyricmute.png (1 bytes)
%Program Files%\YYMusic\201425\audio.dll (3616 bytes)
%Program Files%\YYMusic\201425\Skin\PlayProgressForeImage.png (142 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\ÅäÖù¤¾ß\öÔØYYMusic.lnk (789 bytes)
%Program Files%\YYMusic\201425\Skin\random.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\downda.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\mine.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_set.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingrandom.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_015.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_1.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmPopWnd.xml (354 bytes)
%Program Files%\YYMusic\201425\Skin\mini.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmConfig.xml (4 bytes)
%Program Files%\YYMusic\201425\Skin\pl_forward.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\WindowLrcbkIamge.png (732 bytes)
%Program Files%\YYMusic\201425\Skin\btn_close.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_004.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\bg2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_5.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\list_item.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionclose.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\more.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmWindowLrc.xml (174 bytes)
%Program Files%\YYMusic\201425\Skin\bg_2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_3.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\icon.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\min.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\sound100.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmWebBrowser.xml (308 bytes)
%Program Files%\YYMusic\201425\Skin\color_008highlight.bmp (552 bytes)
%Program Files%\YYMusic\201425\Skin\list_scroll_bar.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn-next.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmLrcChild.xml (263 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionseta.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_1.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbig.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclikea2.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\lyrictoplay.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\button.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\playersidebg.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\tab_comm.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_fh.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\FrmColor.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnmin.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\progress_fore.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\reflash.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice1000528.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnfeedback.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn_kw.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_red.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\prev.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_2.png (5 bytes)
%Program Files%\YYMusic\201425\YYJia.exe (21216 bytes)
%Program Files%\YYMusic\201425\Skin\color_001highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\BtnRightTop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\normalVolume.png (2 bytes)
%Program Files%\YYMusic\201425\favorfm.xml (66 bytes)
%Program Files%\YYMusic\201425\Skin\bk.png (3616 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdelete.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\Òôÿµ÷½Úµã.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_sc.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_2.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\loading04.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\border.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdeletea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmSystemMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\close.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_9k.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\frmlogin.xml (3 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_7.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\playinging.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\prevention.png (3 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_13766042.lrc (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionmina.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\320x225.png (784 bytes)
%Program Files%\YYMusic\201425\picture\baidu_e1fe9925bc315c60bbe955728cb1cb134954772a.jpg (784 bytes)
%Program Files%\YYMusic\201425\Unins.exe (9608 bytes)
%Program Files%\YYMusic\201425\Skin\headimg.png (784 bytes)
%Program Files%\YYMusic\201425\Skin\font_bkcolor.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\history.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\random02hover.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\input-password.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_010.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\feedback.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\playerbg02.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_013.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_014.bmp (1 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_262581.lrc (993 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_6.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\pl_icon.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_play.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\list_pause.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\input-user.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\remembertt.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\125x125.jpg (784 bytes)
%Program Files%\YYMusic\201425\Skin\next.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-login2.png (6 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedback.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\DefaultUserImage.jpg (6 bytes)
%Program Files%\YYMusic\201425\Skin\pl_back.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_7.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnexit.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\astop.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\btn-pause.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\playingvoice.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\FrmSetWindowLrcFrame.xml (3 bytes)
%Program Files%\YYMusic\201425\Skin\update.xml (2 bytes)
%Program Files%\YYMusic\201425\channels.xml (784 bytes)
%Program Files%\YYMusic\201425\Skin\playerbg01.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_bd.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\exit.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnmini.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_pause.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionsetahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_002highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\pushedVolume.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-fav.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\downd.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random03a.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01hover.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\list_title_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_itself.png (1 bytes)
%Program Files%\YYMusic\201425\DuiLib.dll (16288 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedbacka.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_btn_on.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnexit - ¸±±¾.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\pl_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\BtnHidePlayList.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pop_bkimage.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\musiclibrary.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\SelectColor_SliderBar_Thumb.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\list_play.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random01a.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontopa.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn-anonymity.png (8 bytes)
%Program Files%\YYMusic\201425\Skin\DownLoadProgressForeImage.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_007highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_whiter.png (318 bytes)
%Program Files%\YYMusic\201425\Skin\mainframeshadow.png (4992 bytes)
%Program Files%\YYMusic\201425\Skin\mini´°.png (1 bytes)
%Program Files%\YYMusic\201425\picture\baidu_c8ea15ce36d3d539f9c9305e3b87e950342ab0b2.jpg (784 bytes)
%Program Files%\YYMusic\201425\Skin\pl_vol.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\bg3.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\dash.png (955 bytes)
%Program Files%\YYMusic\201425\Skin\LoginBk.png (3312 bytes)
%Program Files%\YYMusic\201425\Skin\list.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\hotkeytipbk.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\random02.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\next0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\play0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_004highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\frmplayer.xml (10 bytes)
%Program Files%\YYMusic\201425\Data\setup.ini (111 bytes)
%Program Files%\YYMusic\201425\Skin\back.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\search.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\forgettt.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\playerlist.png (4 bytes)
%Program Files%\YYMusic\201425\PlayerUpdate.exe (5064 bytes)
%Program Files%\YYMusic\201425\Skin\voiceall0528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_btn_down.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_009.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclikea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\progresstooltipbk.png (1552 bytes)
%Program Files%\YYMusic\201425\Skin\home.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\btn-login.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\bkcolor_4.png (5 bytes)
%Program Files%\YYMusic\201425\lyrics\baidu_13881991.lrc (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_016.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingplaying.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\list_scroll_bar2.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionminahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_list_bk.png (1552 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbigahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_ok_red.png (2 bytes)
%Program Files%\YYMusic\201425\Data\dh.ini (56 bytes)
%Program Files%\YYMusic\201425\Skin\pl_mutevol.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\color_005.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btntop.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_prev.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\lyriclike.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\MessageBox.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\max.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\loading03.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_011.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_006.bmp (560 bytes)
%Program Files%\YYMusic\201425\Skin\downdahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_big.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_008.bmp (556 bytes)
%Program Files%\YYMusic\201425\avcodec-54.dll (23936 bytes)
%Program Files%\YYMusic\201425\Skin\loading01.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_xm.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\listahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensioncloseahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\slider_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Data\version.ini (32 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionfeedbackahover.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_feedback.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\LyricFrameVoice.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_012.bmp (1 bytes)
%Program Files%\YYMusic\201425\Skin\minea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingpreva.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\sound.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmDropDownMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\power.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\menu.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\fbcaptionbk.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\progresstooltip.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\FrmMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\FrmLrc.xml (7 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_4.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\random02a.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\color_005highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\random03.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\ÒôÿÌõ.png (1 bytes)
%Program Files%\YYMusic\201425\pthreadGC2.dll (3616 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionbiga.png (1 bytes)
%Program Files%\YYMusic\201425\avutil-52.dll (5520 bytes)
%Program Files%\YYMusic\201425\Skin\color_bg.bmp (784 bytes)
%Program Files%\YYMusic\201425\Skin\playingnext.png (4 bytes)
%Program Files%\YYMusic\201425\Skin\color_002.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\color_unsel.bmp (5 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionclosea.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\play2.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\mineahover.png (1 bytes)
%Program Files%\YYMusic\201425\YYMusic.exe (32784 bytes)
%Program Files%\YYMusic\201425\avformat-54.dll (12536 bytes)
%Program Files%\YYMusic\201425\Skin\list_item_bg.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\forecolor_6.png (5 bytes)
%Program Files%\YYMusic\201425\Skin\FrmHotKeyTip.xml (482 bytes)
%Program Files%\YYMusic\201425\Skin\pl_split.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_003highlight.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\playingprev.jpg (1 bytes)
%Program Files%\YYMusic\201425\Skin\frmProgressToolTip.xml (393 bytes)
%Program Files%\YYMusic\201425\Skin\suspensiontop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\AutoRunTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201425\Skin\color_001.bmp (564 bytes)
%Program Files%\YYMusic\201425\Skin\FrmFeedBack.xml (411 bytes)
%Program Files%\YYMusic\201425\Skin\lrclist.png (4 bytes)
%Program Files%\YYMusic\201425\avcore.dll (2392 bytes)
%Program Files%\YYMusic\201425\picture\baidu_c2cec3fdfc03924517c1df928694a4c27d1e2532.jpg (784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\¹Ù·½Ö÷Ò³.lnk (334 bytes)
%Program Files%\YYMusic\201425\Skin\random0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_close.png (1 bytes)
%Program Files%\YYMusic\201425\libav.dll (6360 bytes)
%Program Files%\YYMusic\201425\Skin\voice0a0528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionset.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_small.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\scrollbar.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\collection.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\lyricdeletea2.png (2 bytes)
%Program Files%\YYMusic\201425\Skin\loading02.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\btn_comm.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\voice00528.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\playingrandoma.jpg (2 bytes)
%Program Files%\YYMusic\201425\Skin\sys_check_btn_blue.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_res.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\pl_next.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\steup.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\pl_desktop.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\system_menu_btnsteup.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\btn_db.png (3 bytes)
%Program Files%\YYMusic\201425\Skin\prev0520.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\suspensionmin.png (1 bytes)
%Program Files%\YYMusic\201425\Skin\channel.png (3 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (474 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\OLDSet.Xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\DMSet.Xml (675 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM10Context\PM10Context.db.!mv (604 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM25Context\PM25Context.db.!mv (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\PM10Context[1].xml (604 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\AQIContext\AQIContext.db.!mv (332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\PM25Context[1].xml (615 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db.!mv (571 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\369[1].ico (23474 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AQIContext[1].xml (332 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\369.ico.!mv (23474 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\WeatherContext[1].xml (571 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WeatherRadar" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe /autorun"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_News_201425" = "%Program Files%\YYMusic\201425\YYJia.exe -mini"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_201425" = "%Program Files%\YYMusic\201425\YYMusic.exe -mini" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
