Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /p'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /j'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /s'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /l'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /f'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /o'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /m'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /z'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /p'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /i'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /w'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /x'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /j'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /t'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /c'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /z'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /z'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /h'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /r'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /t'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /r'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /m'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /k'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /w'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /y'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /x'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /i'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /o'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /v'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /v'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /n'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /u'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /k'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /f'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /a'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /d'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /g'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /y'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /e'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /v'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /x'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /k'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /q'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /b'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /a'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /i'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /g'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /f'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /s'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /d'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /q'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /c'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /o'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /l'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /k'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /r'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /g'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /r'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /h'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /l'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /n'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /b'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /s'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /y'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /w'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /h'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /e'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /p'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /p'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /j'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /s'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /u'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /b'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /e'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /u'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /d'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /g'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /j'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /e'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /b'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /u'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /t'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /x'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /y'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /m'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /f'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /v'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /m'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /t'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /i'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /d'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /w'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /h'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /o'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /n'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /z'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qzdum' = '%HOMEPATH%\qzdum.exe /c'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /a'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /l'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /c'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%HOMEPATH%\qzdum.exe /n'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%HOMEPATH%\qzdum.exe /a'
- <Drive name for removable media>:\Passwords.exe
- <Drive name for removable media>:\RCX3.tmp
- <Drive name for removable media>:\RCX2.tmp
- <Drive name for removable media>:\RCX6.tmp
- <Drive name for removable media>:\RCX5.tmp
- <Drive name for removable media>:\RCX4.tmp
- <Drive name for removable media>:\Secret.exe
- <Drive name for removable media>:\qzdum.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\Porn.exe
- <Drive name for removable media>:\RCX1.tmp
- <Drive name for removable media>:\Sexy.exe
- hidden files
- %HOMEPATH%\qzdum.exe
- %HOMEPATH%\qzdum.exe
- <Drive name for removable media>:\qzdum.exe
- <Drive name for removable media>:\autorun.inf
- %HOMEPATH%\qzdum.exe
- <Drive name for removable media>:\Passwords.exe
- <Drive name for removable media>:\Porn.exe
- <Drive name for removable media>:\Sexy.exe
- 'ns#.##lpupdates.biz':9002
- 'ns#.##lpupdates.com':9002
- '25#.#55.255.255':9002
- 'ns#.##lpupdates.net':9002
- 'ns#.##lpupdates.org':9002
- 'ns#.###pupdates.info':9002
- DNS ASK ns#.##lpupdates.biz
- DNS ASK ns#.##lpupdates.com
- DNS ASK ns#.###pupdates.info
- DNS ASK ns#.##lpupdates.net
- DNS ASK ns#.##lpupdates.org
- ClassName: 'Indicator' WindowName: ''