Adware.Siggen.32089

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'kxesc' = '"%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe" -autorun'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\kxescore] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\kxescore] 'ImagePath' = '"%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore'
[<HKLM>\System\CurrentControlSet\Services\kisknl] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\kisknl] 'ImagePath' = '<DRIVERS>\kisknl.sys'
[<HKLM>\SYSTEM\ControlSet001\services\kisknl] 'ImagePath' = '<DRIVERS>\kisknl.sys'
[<HKLM>\SYSTEM\ControlSet001\services\kisknl] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet002\services\kisknl] 'ImagePath' = '<DRIVERS>\kisknl.sys'
[<HKLM>\SYSTEM\ControlSet002\services\kisknl] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\kisnetm] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\kisnetm] 'ImagePath' = '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys'
[<HKLM>\System\CurrentControlSet\Services\ksapi64] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ksapi64] 'ImagePath' = '<DRIVERS>\ksapi64.sys'

Creates the following services

'kxescore' "%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
'kisknl' <DRIVERS>\kisknl.sys
'kisnetm' %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys
'ksapi64' <DRIVERS>\ksapi64.sys

Malicious functions

Registers file system filter

[<HKLM>\System\CurrentControlSet\Services\kisknl] 'Group' = 'FSFilter Anti-Virus'
[<HKLM>\System\CurrentControlSet\Services\ksapi64] 'Group' = 'FSFilter Anti-Virus'

Modifies file system

Creates the following files

%TEMP%\kantivirus\kavsetup.log
%PROGRAMDATA%\kingsoft\kis\kich\3954-5ea9c41b-5f0e1228-186.ich
%PROGRAMDATA%\kingsoft\kis\kich\3954-5f6bae2c-5f0e1228-186.ich
%PROGRAMDATA%\kingsoft\kis\kich\3954-5a24b8a9-5f0e1228-177.ich
%PROGRAMDATA%\kingsoft\kis\kich\3954-5be6d29e-5f0e1228-177.ich
%PROGRAMDATA%\kingsoft\kis\kich\3954-59a06cc7-5f0e1228-177.ich
%PROGRAMDATA%\kingsoft\kis\kich\4035-496aa5fd-5f0e1228-177.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\rcmdlocal.dat
%PROGRAMDATA%\kingsoft\kis\kich\3954-70cb815d-5f0e1228-167.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\poplog.db
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\poplog.db-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fdsdcache.db
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\option.ini
%PROGRAMDATA%\kingsoft\kis\kich\3954-40bb5d86-5f0e1229-280.ich
%PROGRAMDATA%\kingsoft\kis\kich\3060-d97feb43-5f0e1225-38a.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fdsdcache.db-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\webui\icon\btbg.gif
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kfloatmain.log
%PROGRAMDATA%\kingsoft\kis\kws\dfcache.dat
%PROGRAMDATA%\kingsoft\ksbw\kns2.che
%PROGRAMDATA%\kingsoft\kis\kich\3956-c30cdf53-5f0e121e-f.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll.log
%PROGRAMDATA%\kingsoft\kis\kws\urlcache.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\shrink_skin_history.ini
%PROGRAMDATA%\kingsoft\kis\kich\1038-53e237a5-5f0e1228-33c.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kxesetting.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kav\index.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkav.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkav.datx
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\ksoftmgrindex.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\ksoftmgrindex.dat.z
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\data\index.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\data\index.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\index.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\index.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krcmdtool.dll.rcmdtmp
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexdata.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\bootoptcfg.ini
%PROGRAMDATA%\kingsoft\kis\kich\3954-5cef7a42-5f0e1228-196.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\indexkav.dat
%PROGRAMDATA%\kingsoft\kis\kich\3954-46709f6d-5f0e122b-34b.ich
%PROGRAMDATA%\kingsoft\kis\kich\3954-433f89e8-5f0e122b-34b.ich
%PROGRAMDATA%\kingsoft\kis\kich\3954-42fde3df-5f0e122b-33c.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\krcmdmon\updatebin.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat_t
%PROGRAMDATA%\kingsoft\kis\kich\4035-2d0660f9-5f0e1229-138.ich
%PROGRAMDATA%\kingsoft\kis\kich\3981-496d22ad-5f0e1229-da.ich
%PROGRAMDATA%\kingsoft\kis\kich\4035-507194bc-5f0e1229-bb.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\bdmisc.dat
%PROGRAMDATA%\kingsoft\kis\kich\1287-989346ca-5f0e1229-4e.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\indexkav.txt
%PROGRAMDATA%\kingsoft\kis\kich\1877-4c2f6e8-5f0e1229-3e.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat
%PROGRAMDATA%\kingsoft\kis\kich\1942-2a5afbb3-5f0e121c-4e.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kav\index.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksapi.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\5.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\4.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\3.jpg
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\2.jpg
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\1.jpg
<DRIVERS>\ksskrpr.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksskrpr.sys
<DRIVERS>\ksapi64.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksapi64.sys
<DRIVERS>\ksapi.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\atl71.dll.z
<DRIVERS>\kisnetm64.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys
<DRIVERS>\kisnetm.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm.sys
<DRIVERS>\kisknl64.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\kisknl64.sys
<DRIVERS>\kisknl.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\zlib1.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\wfs.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetmxp.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexdata.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.log
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatwinsetting.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_hfps.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_hfps.dat-journal
%PROGRAMDATA%\kingsoft\kis\kich\1942-538418b3-5f0e121a-186.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_dps.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_dps.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll.log
%PROGRAMDATA%\kingsoft\kis\kich\4035-6247f63e-5f0e121a-242.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\user.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kfloatwin.log
%PROGRAMDATA%\kingsoft\kis\kich\3954-728d3f04-5f0e1219-bb.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kws_init.log
C:\users\public\desktop\金山毒霸.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\金山毒霸.lnk
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.log
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\desktop.ini
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\访问金山公司网站\金山公司主页.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\访问金山公司网站\金山毒霸网站.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\访问金山公司网站\金山毒霸官方社区.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\访问金山公司网站\金山毒霸官方微博.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\日志查看器.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\病毒隔离系统.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\卸载金山毒霸.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\金山毒霸\在线升级.lnk
%PROGRAMDATA%\kingsoft\kis\hg.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kslaunch.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\atl71.dll
%PROGRAMDATA%\kingsoft\kis\kich\330-d42f0d72-5f0e1241-2ee.ich
%PROGRAMDATA%\kingsoft\kis\kich\742-e4bf985-5f0e1241-2de.ich
%PROGRAMDATA%\kingsoft\kis\kich\742-6293f981-5f0e1241-2de.ich
%PROGRAMDATA%\kingsoft\kis\kich\742-f4a4262b-5f0e1241-29f.ich
%PROGRAMDATA%\kingsoft\kis\kich\2041-714f1640-5f0e1240-109.ich
%PROGRAMDATA%\kingsoft\kis\kich\2041-51903943-5f0e1240-fa.ich
%PROGRAMDATA%\kingsoft\kis\kich\2041-a2409418-5f0e1240-ea.ich
%PROGRAMDATA%\kingsoft\kis\kich\2041-a2a4a6ad-5f0e1240-ea.ich
%PROGRAMDATA%\kingsoft\kis\kich\2041-6b2ec9f6-5f0e1240-ea.ich
%PROGRAMDATA%\kingsoft\kis\kich\2041-e060579e-5f0e1240-da.ich
%PROGRAMDATA%\kingsoft\kis\kich\1512-ceb5bacc-5f0e1240-cb.ich
%PROGRAMDATA%\kingsoft\kis\kich\742-208b734-5f0e1242-1b5.ich
%PROGRAMDATA%\kingsoft\kis\kich\816-5cfab7a7-5f0e123e-3c8.ich
%PROGRAMDATA%\kingsoft\kis\kich\742-61cf3ef4-5f0e123d-f.ich
%PROGRAMDATA%\kingsoft\ksbw\temp\data.fsg
%PROGRAMDATA%\kingsoft\ksbw\temp\conf.ini
%PROGRAMDATA%\kingsoft\ksbw\temp\fsge245.tmp
%PROGRAMDATA%\kingsoft\kfc\kfcwsign.dat
%PROGRAMDATA%\kingsoft\kfc\kfcwsign.dat-journal
%PROGRAMDATA%\kingsoft\kfc\temp\kuze737.tmp
%PROGRAMDATA%\kingsoft\kfc\temp\kdld505.tmp
%PROGRAMDATA%\kingsoft\kfc\kfcbase.dat
%PROGRAMDATA%\kingsoft\kis\kich\2285-598a90b8-5f0e123a-128.ich
%PROGRAMDATA%\kingsoft\kis\kich\2285-c578abd6-5f0e123a-7d.ich
%WINDIR%\temp\uddde7d.tmp
%PROGRAMDATA%\kingsoft\kfc\kfcbase.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\sqlite.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\softreport.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkxeapp.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkxeapp.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\ksg\index.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\ksg\index.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexksg.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexksg.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kcom_kvm2\index.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kcom_kvm2\index.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkcom_kvm2.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkcom_kvm2.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kcom_khackfix\index.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkcom_common.dat
%PROGRAMDATA%\kingsoft\ksbw\ksbw_wib.fsg
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkcom_khackfix.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kcom_commonfast\index.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kcom_commonfast\index.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkcom_commonfast.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkcom_commonfast.dat
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kcom_common\index.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kcom_common\index.dat
%PROGRAMDATA%\kingsoft\kis\kich\742-850880c3-5f0e1243-222.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\deflist.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkcom_khackfix.txt
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkcom_common.txt
<DRIVERS>\kisnetmxp.sys
%PROGRAMDATA%\kingsoft\kis\kich\514-cef36ffe-5f0e1238-ea.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\fileuploadinfo.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa0.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa0.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kseexf.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksepnf.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kseset.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\defmsg.log
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fluxstastic.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fluxcache.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\download_engine.dll.z
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\startupbrowser.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa1.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\procinfo.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\urlmon.cfg
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\ksdecs_trace.log
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\kmctrl_trace.log
%WINDIR%\temp\uddbf7a.tmp
%WINDIR%\temp\uddbf2b.tmp
%PROGRAMDATA%\kingsoft\kis\kich\3595-9320bf6c-5f0e1231-1e4.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\deconfig.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\dl_peer_id.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\expand_rule.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\dl_peer_id.dll.z
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\rule.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\autoflux.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksantiloaddll.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\ksdectrl_trace.log
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa1.dat-journal
%WINDIR%\syswow64\config\systemprofile\desktop\desktop.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\leakreinforce.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\deflog.db
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\deflog.db-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\klengine.log
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\progrule.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\progrule.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksuset.db
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksuset.db-journal
%PROGRAMDATA%\kingsoft\kis\kich\4222-46e8732-5f0e1237-32c.ich
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\fileuploadinfo.dat
%PROGRAMDATA%\kingsoft\ksbw\ksbwlog.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe.0.log
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksecachecfg.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\switch.dat
%TEMP%\kantivirus\kresult.log
%PROGRAMDATA%\kingsoft\kis\installtimecfg.dat
%PROGRAMDATA%\kingsoft\ksbw\ksbwctrl2_1.che
%PROGRAMDATA%\kingsoft\ksbw\ksbwbase.dat
%PROGRAMDATA%\kingsoft\ksbw\ksbwbase.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\ksbwfile.dat
%PROGRAMDATA%\kingsoft\ksbw\ksbwfile.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\ksbwlog3.dat
%PROGRAMDATA%\kingsoft\ksbw\ksbwlog3.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\quarantine.count
%PROGRAMDATA%\kingsoft\ksbw\ksbwlog.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\scom.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\netbuyprot.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\msvcr80.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\kdock.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\quarantine.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\push_msg_city_list.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksscfgx.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kshmpg.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksedset.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksedset.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksecfg.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksbwdt.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\kismain.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\khistory.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\start_acc.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\signs.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\scom.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\installdk.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\deheurcfg.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\config.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\broplugver.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_weibo.htm
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_main.htm
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_duba.htm
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_bbs.htm
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\weatherconfig.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\speedtest.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\kaecore.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\kcommon.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\uninstallcfg.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\fnsign.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\gamesdb_dc_mini.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kpld.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kplc.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdh.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\operation\cas\kctrl.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\karchive.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\kaecore.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\kaearchb.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\kaearcha.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kaccclear.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\inject.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kpretend.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\vinfo.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe.bak
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\delaydownloader.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\config3a.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\cleanlist.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\bredirect.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\recommendctrl.config
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\liectrl.config
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\cloudctrl.config
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\bro.cfg
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe.bak
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe.bak
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\deswitch.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kxeapp\index.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kqsccfg.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\game.xml
%TEMP%\kantivirus\~fe892\install_res\507.png
%TEMP%\kantivirus\~fe892\install_res\200.bmp
%TEMP%\kantivirus\~fe892\install_res\518.png
%TEMP%\kantivirus\~fe892\install_res\517.png
%TEMP%\kantivirus\~fe892\install_res\516.png
%TEMP%\kantivirus\~fe892\install_res\515.png
%TEMP%\kantivirus\~fe892\install_res\514.png
%TEMP%\kantivirus\~fe892\install_res\512.png
%TEMP%\kantivirus\~fe892\install_res\511.png
%TEMP%\kantivirus\~fe892\install_res\510.png
%TEMP%\kantivirus\~fe892\install_res\509.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\install.xml
%TEMP%\kantivirus\~fe892\clear_i.xml
%TEMP%\kantivirus\~fe892\install_res\506.png
%TEMP%\kantivirus\~fe892\install_res\504.png
%TEMP%\kantivirus\~fe892\install_res\503.png
%TEMP%\kantivirus\~fe892\install_res\502.png
%TEMP%\kantivirus\~fe892\install_res\501.png
%TEMP%\kantivirus\~fe892\install_res\5.png
%TEMP%\kantivirus\~fe892\install_res\4.png
%TEMP%\kantivirus\~fe892\install_res\110.png
%TEMP%\kantivirus\~fe892\install_res\3.jpg
%TEMP%\kantivirus\~fe892\install_res\2.jpg
%TEMP%\kantivirus\~fe892\install_res\1.jpg
%TEMP%\kantivirus\~fe892\install_res\508.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksoft.xml
%TEMP%\kantivirus\~fe892\ksoft.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\computer_acc.png
%TEMP%\kantivirus\~fe892\product.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\forecastmsg.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\clear.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\citys.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\microsoft.vc80.mfc.manifest
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\duba123new.ico
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\duba123ienew.ico
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\duba123ie.ico
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\duba123.ico
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\wendujishrink_skin_img.png
%TEMP%\kantivirus\~fe892\setup.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\trash_scan.png
%TEMP%\kantivirus\~fe892\install_res\201.bmp
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\scan_virus.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\reinstall_duba.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\pop.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\lockpage.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\kongqizhiliang_skin_img.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\jijian_skin_img.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\forbidmobile.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\dudubao_skin_img.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\defaultshrink_skin_img.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\computer_doctor.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\tianshizhiyi_skin_img.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kcom_khackfix\index.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krcmddb.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kunioncfg.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksdectrl.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksdecs.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kscanner.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksapi64.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksapi.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ks3rdhmpg64.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ks3rdhmpg32.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ks3rdhmpg.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krcmdutils.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krcmdbase.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\config\ksesysfiles.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kpopsvr.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kpassport.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\knetworkpanel.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kmonstat.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\kmctrl.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\klengine.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kismain.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\kislog.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kisfdpro64.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\khistory.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\khandler.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kpopclt.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kfloatwin.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kfloatmain.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kshmpg.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksesscan.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\msvcp80.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\lblocker.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\lbhelper.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kxesansp.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxereg.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxecore\kxecore.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxebscsp.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxebase.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsui64.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsui.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kseutil.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwssp.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kseescan.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktoolupd.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksysopteng.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kswscxex.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kswebshield.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kstools.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksscore.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksreng3.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kspupwnd.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kskinmgr.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kshmpgext.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kupdatesp.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksfilter.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktrashscan.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\shrink_skin_config.ini
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\dudubao.skin
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\sp3a.nlb
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\rule.krf
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\krmcdm.krf
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\denyip.krf
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxeksgpid.kid
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwifitool.kid
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kvmpid2.kid
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\khackfix.kid
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kcommonpid.kid
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavpid.kid
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdgui2.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\operation\cas\kfmt.datx
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\whiteurl.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\upcfg.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\softicon.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\se.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\safeurl.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\productinfo.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\netmodeconfig.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\netbank.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\lpolicy.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsu.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwnp.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\winesystem001.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\keasyipcn.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\wenduji.skin
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\kongqizhiliang.skin
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdefendpop.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kclearpanel.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kcctrl.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kavquara.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavmenu64.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavmenu.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavevent.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\jsonv6.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\defendmon.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\uni0nst.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\tianshizhiyi.skin
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsprotect64.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\jijian.skin
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksetupwiz.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kscan.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krecycle.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kismain.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdrvmgr.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdf.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kcleaner.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavlog2.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore_sp.xcf
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\uplive.svr
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kupdata.exe
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kxeapp\index.txt

Sets the 'hidden' attribute to the following files

%WINDIR%\syswow64\config\systemprofile\desktop\desktop.ini

Deletes the following files

%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe.bak
%TEMP%\kantivirus\~fe892\install_res\506.png
%TEMP%\kantivirus\~fe892\install_res\507.png
%TEMP%\kantivirus\~fe892\install_res\508.png
%TEMP%\kantivirus\~fe892\install_res\509.png
%TEMP%\kantivirus\~fe892\install_res\510.png
%TEMP%\kantivirus\~fe892\install_res\511.png
%TEMP%\kantivirus\~fe892\install_res\512.png
%TEMP%\kantivirus\~fe892\install_res\514.png
%TEMP%\kantivirus\~fe892\install_res\515.png
%TEMP%\kantivirus\~fe892\install_res\516.png
%PROGRAMDATA%\kingsoft\ksbw\ksbwlog.dat-journal
%TEMP%\kantivirus\~fe892\install_res\517.png
%TEMP%\kantivirus\~fe892\ksoft.xml
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\fileuploadinfo.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksuset.db-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\progrule.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\deflog.db-journal
%PROGRAMDATA%\kingsoft\kfc\kfcbase.dat-journal
%PROGRAMDATA%\kingsoft\kfc\temp\kdld505.tmp
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat
%PROGRAMDATA%\kingsoft\kfc\kfcwsign.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\temp\fsge245.tmp
%TEMP%\kantivirus\~fe892\install_res\503.png
%TEMP%\kantivirus\~fe892\install_res\504.png
%TEMP%\kantivirus\~fe892\install_res\502.png
%TEMP%\kantivirus\~fe892\install_res\501.png
%TEMP%\kantivirus\~fe892\install_res\5.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe.bak
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_dps.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_hfps.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\poplog.db-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwifitool.kid
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fdsdcache.db-journal
%WINDIR%\temp\uddbf2b.tmp
%WINDIR%\temp\uddbf7a.tmp
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa0.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\temp\conf.ini
%TEMP%\kantivirus\~fe892\install_res\518.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa1.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\ksbwfile.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\ksbwbase.dat-journal
%TEMP%\kantivirus\~fe892\clear_i.xml
%TEMP%\kantivirus\~fe892\install_res\1.jpg
%TEMP%\kantivirus\~fe892\install_res\110.png
%TEMP%\kantivirus\~fe892\install_res\2.jpg
%TEMP%\kantivirus\~fe892\install_res\200.bmp
%TEMP%\kantivirus\~fe892\install_res\201.bmp
%TEMP%\kantivirus\~fe892\install_res\3.jpg
%TEMP%\kantivirus\~fe892\install_res\4.png
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe.bak
%PROGRAMDATA%\kingsoft\ksbw\ksbwlog3.dat-journal
%WINDIR%\temp\uddde7d.tmp

Moves the following files

from %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat_t to %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat
from <DRIVERS>\kisknl.sys to <DRIVERS>\kisknl_del.sys
from %PROGRAMDATA%\kingsoft\kfc\temp\kuze737.tmp to %PROGRAMDATA%\kingsoft\kfc\kfcdyncfg.ini
from %PROGRAMDATA%\kingsoft\ksbw\temp\data.fsg to %PROGRAMDATA%\kingsoft\ksbw\ksbw_wi.fsg

Substitutes the following files

%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\poplog.db-journal
<DRIVERS>\kisknl.sys
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa0.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa1.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\ksbwlog.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\ksbwfile.dat-journal
%PROGRAMDATA%\kingsoft\ksbw\ksbwbase.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\progrule.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\deflog.db-journal
%PROGRAMDATA%\kingsoft\kfc\kfcbase.dat-journal
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat_t
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat

Network activity

Connects to

'22#.#28.204.36':80

TCP

HTTP GET requests

http://ap#.#c120.com/time/?u=#############################################
http://cu###.www.duba.net/duba/2011/kcomponent/kcom_common/77a1c800.dat
http://11#.#3.89.14/
http://www.pc##0.com/api/adrules/check_subs/?c=##################################################################################################################################################...
http://cu###.www.duba.net/duba/2011/kcomponent/kcom_common/kcom_common/34951e8bd03060a0083d4aed64b78a77
http://cu###.www.duba.net/duba/2011/kcomponent/kcom_commonfast/7795bdb0.dat
http://11#.#3.89.12/
http://b.###.pc120.com/utp/%20?p=############################
http://cu###.www.duba.net/duba/2011/kcomponent/kcom_commonfast/kcom_commonfast/8f3bc3ffa5d8a0a760af3a45f59249b7
http://cu###.www.duba.net/duba/2011/kcomponent/kcom_kvm2/77851921.dat
http://cu###.www.duba.net/duba/2011/kcomponent/kcom_kvm2/kcom_kvm2/084a2e3aa06f6a539fc5550d21a53fde
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://cu###.www.duba.net/duba/kisengine/lib/77a28d4b.dat
http://cu###.www.duba.net/duba/kisengine/lib/ksg/9159969349ff69453310d5e6de0a8aa4
http://cu###.www.duba.net/duba/2011/kcomponent/kcom_khackfix/65b096a8.dat
http://cu###.www.duba.net/duba/2011/kcomponent/kcom_khackfix/kcom_khackfix/3629787f17f94cc26440efee732e9c8e
http://cl####q.duba.net/abc
http://cu###.www.duba.net/kcs/kfsg/fsgs/kswfsign
http://cu###.www.duba.net/kcs/kfsg/config/kfcdyncfg
http://12#.#2.183.150/
http://rc##.##p.ijinshan.com/krcmdinst/1335/updatebin.xml
http://cu###.www.duba.net/duba/kisengine/data/7792a8e8.dat
http://hu###.www.duba.net/duba/2010/bin/1335/77a28ca3.dat
http://rc##.##p.ijinshan.com/krcmdinst/1335/krcmdtool.dll
http://hu###.www.duba.net/duba/2010/bin/1335/kav/d52b22fbd24a26d176e9546496f7769c
http://cu###.www.duba.net/duba/tools/dubatools/ksysoptak47.dat
http://cu###.www.duba.net/duba/kisengine/data/data/bbd0f3f650b3079ec101399860c082c6
http://cu###.www.duba.net/duba/2010/bin/1335/77a28ca3.datx
http://cu###.www.duba.net/duba/2010/bin/1335/kav/d52b22fbd24a26d176e9546496f7769c
http://hu###.www.duba.net/duba/2010/bin/1335/kav/xlmodule/download/627a3da95ced254e8ae2c9592153015b
http://hu###.www.duba.net/duba/2010/bin/1335/kav/xlmodule/download/f0955a681cb6919e432556e783fb04ed
http://hu###.www.duba.net/duba/2010/bin/1335/kav/xlmodule/download/cb02dbaee15d1c9ecf7a7f012e044253
http://cv.#uba.net/cv?uu####################################################################
http://hu###.www.duba.net/duba/2010/bin/1335/kav/7fa2567c4edbce545470dc5725d63db7
http://cu###.www.duba.net/duba/kisengine/app/1335/77a28ed8.dat
http://cu###.www.duba.net/duba/kisengine/app/1335/kxeapp/757d23c0237fefbaad6899315297147a

HTTP POST requests

http://di#.##inshan.com/db/?v=############################################################################################################
http://ct.#uba.net/itid
http://kn#.#uba.net/kns-query?10#############
http://rq.#####de.cloud.duba.net/query?10#####
http://tj.####n.ijinshan.com/c/
http://rq.###.cloud.duba.net/query?15########
http://kn#.#uba.net/kns-query?10#####
http://in###2.duba.net/c/
http://in###2.duba.net/nep/v1/
http://in###0.duba.net/c/
http://kn#.#uba.net/kns-query?11#####
http://rq.#####ize.cloud.duba.net/pquery?11#####
http://kn###.##oud.duba.net:8080/kurl_query?11##### via kn###.#loud.duba.net

UDP

DNS ASK di#.##inshan.com
DNS ASK so##.com
DNS ASK pc##0.com
DNS ASK 16#.com
DNS ASK qq.com
DNS ASK rq.#####ize.cloud.duba.net
DNS ASK si##.com
DNS ASK f-####s.duba.net
DNS ASK b.###.pc120.com
DNS ASK in###2.duba.net
DNS ASK rq.###.cloud.duba.net
DNS ASK tj.####n.ijinshan.com
DNS ASK hu###.www.duba.net
DNS ASK cu###.www.duba.net
DNS ASK rc##.##p.ijinshan.com
DNS ASK rq.#####de.cloud.duba.net
DNS ASK ap#.#c120.com
DNS ASK cl####q.duba.net
DNS ASK kn#.#uba.net
DNS ASK kn###.#loud.duba.net
DNS ASK wq.###ud.duba.net
DNS ASK cv.#uba.net
DNS ASK ct.#uba.net
DNS ASK in###0.duba.net
DNS ASK xu##ei.com
DNS ASK ba##u.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: '{677B9715-5692-49f6-979F-CD11EC963EFE}'
ClassName: '{677B9715-5692-49f6-979F-CD11EC963EFE}' WindowName: ''
ClassName: 'kingsoft antivirus package win' WindowName: '金山毒霸-安装向导'
ClassName: '' WindowName: 'gameoptwnd'
ClassName: '' WindowName: 'kxetray{DF737DA7-CDCC-4e53-BE4F-96706694ED9F}'
ClassName: 'Progman' WindowName: 'Program Manager'

Creates and executes the following

'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavlog2.exe' -install
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe' /autorun /hidefloatwin /silentinstrcmd
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe' /start kxescore
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe' /autorun /std /skipcs3
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe' /service kxescore
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsprotect64.exe' (null)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kupdata.exe' -locknb
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavlog2.exe' -install' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe' /autorun /hidefloatwin /silentinstrcmd' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe' /start kxescore' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe' /autorun /std /skipcs3' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsprotect64.exe' (null)' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kupdata.exe' -locknb' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial