Adware.Chindo.5

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'RSDTRAY' = '"%ProgramFiles(x86)%\Rising\RSD\popwndexe.exe"'

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\RsMgrSvc] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\RsMgrSvc] 'ImagePath' = '"%ProgramFiles(x86)%\Rising\RSD\RsMgrSvc.exe"'

Creates the following services

'RsMgrSvc' "%ProgramFiles(x86)%\Rising\RSD\RsMgrSvc.exe"
'RsMgrSvc' %ProgramFiles(x86)%\Rising\RSD\RsMgrSvc.exe

Modifies file system

Creates the following files

%TEMP%\nsxc0c0.tmp
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\64\rsutils.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\rsdll.dll.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\kguard.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\kguard_if.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\hookbase.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\rsndisp.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\64\rsndisp.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\rsutils_if.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\rsutils.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\sysmon.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\license\12345678.000
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\sysmon_if.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\64\sysmon.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\mondrv.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\cloudqry.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\rsnscfg.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\rscurl.dll
%ProgramFiles(x86)%\rising\rsd\rsdk.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\license\license.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\moncomm.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\dfw.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\comx3.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\rscombas.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmon\ravmon.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmon\mondcoms.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmon\mond.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\rsdk.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\rsxml3a.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\rsxml3w.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\cloudnet.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\cloudsta.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\atl90.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\procenv.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\rscom.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\mscrt9.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\msvcr90.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\msvcp90.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\microsoft.vc90.atl.manifest
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\traywnd.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\hookbase.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\cloudqry.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscfg\rscfg.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\rssrv.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rssetup.xml
%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.exe
%ProgramFiles(x86)%\rising\rsd\rsstub.exe
%ProgramFiles(x86)%\rising\rsd\updater.exe
%ProgramFiles(x86)%\rising\rsd\setup.exe
%ProgramFiles(x86)%\rising\rsd\cfgdll.dll
%ProgramFiles(x86)%\rising\rsd\rsappmgr.dll
%ProgramFiles(x86)%\rising\rsd\comx3.dll
%ProgramFiles(x86)%\rising\rsd\rslang.dll
%ProgramFiles(x86)%\rising\rsd\os.xml
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rstoredll.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\ui\snin.htm
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsdk.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsmginfo.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\localopt.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\popwndexe.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsd932\jpn.lag
%ProgramFiles(x86)%\rising\rsd\setup.dat
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsd950\cht.lag
%ProgramFiles(x86)%\rising\rsd\update.xml
%ProgramFiles(x86)%\rising\rsd\rsd936\chs.lag
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscfg\rscfg.dll
%ProgramFiles(x86)%\rising\rsd\syslay.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\_rav\_rav.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\_rav\setup.xml
%ProgramFiles(x86)%\rising\rsd\data\rav\rav.ini
%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.exe.log
%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.dat
%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.ini
%ProgramFiles(x86)%\rising\rsd\rsdinfo.dll
%ProgramFiles(x86)%\rising\rsd\xmls\rssetup.xml
%ProgramFiles(x86)%\rising\rsd\ui\snin.htm
%ProgramFiles(x86)%\rising\rsd\rsbackup.exe
%ProgramFiles(x86)%\rising\rsd\rsmginfo.dll
%ProgramFiles(x86)%\rising\rsd\localopt.dll
%ProgramFiles(x86)%\rising\rsd\popwndexe.exe
%ProgramFiles(x86)%\rising\rsd\rsd932\jpn.lag
%ProgramFiles(x86)%\rising\rsd\rsd1252\eng.lag
%ProgramFiles(x86)%\rising\rsd\rsd950\cht.lag
%ProgramFiles(x86)%\rising\rsd\rstoredll.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsd1252\eng.lag
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\ravmond.exe
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\logdc.bmp
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\x64\adefmon.mond
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\adefmon.mond
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\defmon.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\bacore.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\selfmon.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\ravdefdb.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\uprsuser.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\uprsmon.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\rsuser.db1
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\monrule.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\rsmon.db1
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudv3.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\datastorage.db
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\userdata.rstray
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\userdata.mond
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudnotifier.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\dataups.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\mondef.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\localopt.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\bawhite.dll
%TEMP%\nsxc10f.tmp\duba_1_219.exe
%TEMP%\etilqs_lz2qkdotnqyc4bd
%TEMP%\etilqs_npz6eggymagdfuo
%TEMP%\etilqs_z3gzu4goyhkbitz
%TEMP%\etilqs_k3shdgqxiy1mayw
%TEMP%\etilqs_6lndpinbldykoxq
%TEMP%\etilqs_hzbo3leiagj4dhy
%TEMP%\etilqs_senq2lxev9urr5d
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudwork.dll
%TEMP%\nsxc10f.tmp\baidu_com_90000294.exe
%TEMP%\etilqs_6gpbdytsmmnmyam
%TEMP%\nsxc10f.tmp\sohuva_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
%TEMP%\rspcver12.xml.rs
%ALLUSERSPROFILE%\rising\rav\language.ini
%ALLUSERSPROFILE%\rising\rav\rav.ini
%ProgramFiles(x86)%\rising\rav\netconfig.ini
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\rsmondef.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\antipromotionmon.dll
%TEMP%\etilqs_ohd6jsggt4t38yh
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\bawhite.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudstore.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudv3.dll
%TEMP%\rsdsfxtmp\rscomm\proccomm.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rstask.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\repairmanager.mond
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rssmall.bmp
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\pngdll.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rspalvd.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\repair.url
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\url.ini
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\setup.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\repairmanager.mondcoms
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\repairmanager.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\monbasedui.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rav.ico
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rsmain.ico
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rising.ico
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rstray.ico
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\ravsetup.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rav936\rav936.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rav936\chs.lag
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\logac.bmp
%ProgramFiles(x86)%\rising\rsd\backup\rav\rav936\lics936.txt
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\ravbase.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\proccom.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\proccomm.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravxp\ravxp.exe
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\rscomm.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\rsbasenetwrapper.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\rssqlite.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\rscommx2.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\moncom08.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\syslay.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravxp\ravxp.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravconfig\ravcfg.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravconfig\mergexml.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\cnt09.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmaindui\ravmaindui.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmaindui\rsmain.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmaindui\rsmain.exe
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravlog\ravlog.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravlog\rslog.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravconfig\ravconfig.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\cnt08.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsd936\chs.lag
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsdinfo.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\update.xml
%TEMP%\rsdsfxtmp\ravdefdb\uprsmon.dat
%TEMP%\rsdsfxtmp\setup.dat
%TEMP%\rsdsfxtmp\ravbase\setup.dat
%TEMP%\rsdsfxtmp\cloudqry\rsnscfg.dat
%TEMP%\rsdsfxtmp\hookbase\rsdll.dll.dat
%TEMP%\rsdsfxtmp\label.dat
%TEMP%\rsdsfxtmp\cloudv3\dataups.dat
%TEMP%\rsdsfxtmp\rsmondef\bawhite.dat
%TEMP%\rsdsfxtmp\cloudv3\datastorage.db
%TEMP%\rsdsfxtmp\compsver.inf
%TEMP%\rsdsfxtmp\ravbase\url.ini
%TEMP%\rsdsfxtmp\auto.ini
%TEMP%\rsdsfxtmp\rav936\lics936.txt
%TEMP%\rsdsfxtmp\ui\snin.htm
%TEMP%\rsdsfxtmp\_rav\_rav.xml
%TEMP%\rsdsfxtmp\update.xml
%TEMP%\rsdsfxtmp\ravdefdb\rsmon.db1
%TEMP%\rsdsfxtmp\license\12345678.000
%TEMP%\rsdsfxtmp\updater.exe
%TEMP%\rsdsfxtmp\rsd936\chs.lag
%TEMP%\rsdsfxtmp\rsmgrsvc.exe
%TEMP%\rsdsfxtmp\ravmaindui\rsmain.exe
%TEMP%\rsdsfxtmp\rsbackup.exe
%TEMP%\rsdsfxtmp\ravxp\ravxp.exe
%TEMP%\rsdsfxtmp\monbasedui\ravmond.exe
%TEMP%\rsdsfxtmp\popwndexe.exe
%TEMP%\rsdsfxtmp\ravbase\repair.url
%TEMP%\rsdsfxtmp\_rav\setup.xml
%TEMP%\rsdsfxtmp\cloudv3\userdata.rstray
%TEMP%\rsdsfxtmp\ravdefdb\rsuser.db1
%TEMP%\rsdsfxtmp\ravbase\repairmanager.mond
%TEMP%\rsdsfxtmp\rsmondef\x64\adefmon.mond
%TEMP%\rsdsfxtmp\rsmondef\adefmon.mond
%TEMP%\rsdsfxtmp\rsd932\jpn.lag
%TEMP%\rsdsfxtmp\rsd1252\eng.lag
%TEMP%\rsdsfxtmp\rsd950\cht.lag
%TEMP%\rsdsfxtmp\rav936\chs.lag
%TEMP%\rsdsfxtmp\ravbase\repairmanager.mondcoms
%TEMP%\rsdsfxtmp\ravbase\rstask.xml
%TEMP%\rsdsfxtmp\rsstub.exe
%TEMP%\rsdsfxtmp\rssetup.xml
%TEMP%\rsdsfxtmp\rsmondef\rsmondef.xml
%TEMP%\rsdsfxtmp\mscrt9\microsoft.vc90.crt.manifest
%TEMP%\rsdsfxtmp\setup.exe
%TEMP%\rsdsfxtmp\ravbase\rstray.ico
%TEMP%\rsdsfxtmp\ravbase\rsmain.ico
%TEMP%\rsdsfxtmp\ravbase\rising.ico
%TEMP%\rsdsfxtmp\ravbase\rav.ico
%TEMP%\rsdsfxtmp\ravbase\rssmall.bmp
%TEMP%\rsdsfxtmp\ravbase\logdc.bmp
%TEMP%\rsdsfxtmp\cloudqry\cloudqry.xml
%TEMP%\rsdsfxtmp\cloudv3\cloudv3.xml
%TEMP%\rsdsfxtmp\ravbase\logac.bmp
%TEMP%\nsxc10f.tmp\execcmd.dll
%TEMP%\nsxc10f.tmp\kele2014beta3.6.2promote0326_20090195130.exe
%TEMP%\nsxc10f.tmp\nsisdl.dll
%TEMP%\nsxc10f.tmp\base64.dll
%TEMP%\nsxc10f.tmp\1.zip
%TEMP%\nsxc10f.tmp\inetc.dll
%TEMP%\nsxc10f.tmp\system.dll
%TEMP%\rsdsfxtmp\rav.7z
%TEMP%\nsxc10f.tmp\install1078565.exe
%TEMP%\rsdsfxtmp\cloudv3\userdata.mond
%TEMP%\rsdsfxtmp\hookbase\hookbase.xml
%TEMP%\rsdsfxtmp\ravconfig\ravcfg.xml
%TEMP%\rsdsfxtmp\ravconfig\ravconfig.xml
%TEMP%\rsdsfxtmp\rscomm\rscomm.xml
%TEMP%\rsdsfxtmp\rscfg\rscfg.xml
%TEMP%\rsdsfxtmp\ravxp\ravxp.xml
%TEMP%\rsdsfxtmp\ravmon\ravmon.xml
%TEMP%\rsdsfxtmp\ravmaindui\ravmaindui.xml
%TEMP%\rsdsfxtmp\ravlog\ravlog.xml
%TEMP%\rsdsfxtmp\ravdefdb\ravdefdb.xml
%TEMP%\rsdsfxtmp\rsdk\rsdk.xml
%TEMP%\rsdsfxtmp\custom.xml
%TEMP%\rsdsfxtmp\mscrt9\microsoft.vc90.atl.manifest
%TEMP%\rsdsfxtmp\rav936\rav936.xml
%TEMP%\rsdsfxtmp\os.xml
%TEMP%\rsdsfxtmp\mscrt9\mscrt9.xml
%TEMP%\rsdsfxtmp\ravmon\mondcoms.xml
%TEMP%\rsdsfxtmp\ravmon\mond.xml
%TEMP%\rsdsfxtmp\monbasedui\monbasedui.xml
%TEMP%\rsdsfxtmp\license\license.xml
%TEMP%\rsdsfxtmp\ravbase\ravbase.xml
%TEMP%\rsdsfxtmp\ravdefdb\uprsuser.dat
%TEMP%\rsdsfxtmp\rsmondef\antipromotionmon.dll
%TEMP%\rsdsfxtmp\hookbase\64\rsndisp.sys
%TEMP%\rsdsfxtmp\rsdk\rsxml3w.dll
%TEMP%\rsdsfxtmp\protreg.sys
%TEMP%\rsdsfxtmp\hookbase\kguard.sys
%TEMP%\rsdsfxtmp\rsdk\traywnd.dll
%TEMP%\rsdsfxtmp\hookbase\sysmon_if.dll
%TEMP%\rsdsfxtmp\rscomm\syslay.dll
%TEMP%\rsdsfxtmp\syslay.dll
%TEMP%\rsdsfxtmp\rsmondef\selfmon.dll
%TEMP%\rsdsfxtmp\mscrt9\atl90.dll
%TEMP%\rsdsfxtmp\hookbase\rsndisp.sys
%TEMP%\rsdsfxtmp\rslang.dll
%TEMP%\rsdsfxtmp\rstoredll.dll
%TEMP%\rsdsfxtmp\monbasedui\rssrv.dll
%TEMP%\rsdsfxtmp\rscomm\rssqlite.dll
%TEMP%\rsdsfxtmp\ravbase\rspalvd.dll
%TEMP%\rsdsfxtmp\rsmginfo.dll
%TEMP%\rsdsfxtmp\ravmaindui\rsmain.dll
%TEMP%\rsdsfxtmp\ravlog\rslog.dll
%TEMP%\rsdsfxtmp\hookbase\rsutils_if.dll
%TEMP%\rsdsfxtmp\rsdk\rsxml3a.dll
%TEMP%\rsdsfxtmp\hookbase\64\rsutils.sys
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\cfgdll.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\setup.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\syslay.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\comx3.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\setup.dat
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsbackup.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsmgrsvc.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsstub.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\updater.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\protreg.sys
%TEMP%\rsdsfxtmp\hookbase\rsutils.sys
%TEMP%\rsdsfxtmp\hookbase\64\sysmon.sys
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rslang.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\os.xml
%TEMP%\rav.cfg.tmp
%TEMP%\rav.cfg
%TEMP%\rsdsfxtmp\install1078565.exe.log
%ProgramFiles(x86)%\rstest.ini
%TEMP%\rsdsfxtmp\hookbase\sysmon.sys
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsappmgr.dll
%TEMP%\etilqs_dnxc3ixlafcnlht
%ALLUSERSPROFILE%\kingsoft\ksbw\kns2.che
%TEMP%\rsdsfxtmp\cloudqry\rscurl.dll
%TEMP%\rsdsfxtmp\cloudv3\cloudv3.dll
%TEMP%\rsdsfxtmp\hookbase\hookbase.dll
%TEMP%\rsdsfxtmp\rsdk\dfw.dll
%TEMP%\rsdsfxtmp\rsmondef\defmon.dll
%TEMP%\rsdsfxtmp\rsdk\comx3.dll
%TEMP%\rsdsfxtmp\comx3.dll
%TEMP%\rsdsfxtmp\rscomm\cnt09.dll
%TEMP%\rsdsfxtmp\rscomm\cnt08.dll
%TEMP%\rsdsfxtmp\rsdinfo.dll
%TEMP%\rsdsfxtmp\localopt.dll
%TEMP%\rsdsfxtmp\cloudv3\cloudstore.dll
%TEMP%\rsdsfxtmp\cloudqry\cloudsta.dll
%TEMP%\rsdsfxtmp\cloudqry\cloudqry.dll
%TEMP%\rsdsfxtmp\cloudv3\cloudnotifier.dll
%TEMP%\rsdsfxtmp\cloudqry\cloudnet.dll
%TEMP%\rsdsfxtmp\cfgdll.dll
%TEMP%\rsdsfxtmp\rsmondef\bawhite.dll
%TEMP%\rsdsfxtmp\rsmondef\bacore.dll
%TEMP%\rsdsfxtmp\cloudv3\cloudwork.dll
%TEMP%\rsdsfxtmp\rsdk.dll
%TEMP%\rsdsfxtmp\cloudv3\localopt.dll
%TEMP%\rsdsfxtmp\monbasedui\moncomm.dll
%TEMP%\rsdsfxtmp\ravconfig\mergexml.dll
%TEMP%\rsdsfxtmp\rscomm\rscommx2.dll
%TEMP%\rsdsfxtmp\monbasedui\rscombas.dll
%TEMP%\rsdsfxtmp\rsdk\rscom.dll
%TEMP%\rsdsfxtmp\rscfg\rscfg.dll
%TEMP%\rsdsfxtmp\rscomm\rsbasenetwrapper.dll
%TEMP%\rsdsfxtmp\rsappmgr.dll
%TEMP%\rsdsfxtmp\ravbase\repairmanager.dll
%TEMP%\rsdsfxtmp\rscomm\moncom08.dll
%TEMP%\rsdsfxtmp\ravbase\ravsetup.dll
%TEMP%\rsdsfxtmp\hookbase\kguard_if.dll
%TEMP%\rsdsfxtmp\rscomm\proccom.dll
%TEMP%\rsdsfxtmp\ravbase\pngdll.dll
%TEMP%\rsdsfxtmp\mscrt9\msvcr90.dll
%TEMP%\rsdsfxtmp\mscrt9\msvcp90.dll
%TEMP%\rsdsfxtmp\rsmondef\monrule.dll
%TEMP%\rsdsfxtmp\hookbase\mondrv.dll
%TEMP%\rsdsfxtmp\ravdefdb\mondef.dll
%TEMP%\rsdsfxtmp\rsdk\procenv.dll
%ALLUSERSPROFILE%\kingsoft\kis\kws\urlcache.dat

Deletes the following files

%TEMP%\nsxc10f.tmp\kele2014beta3.6.2promote0326_20090195130.exe
%TEMP%\rsdsfxtmp\rav.7z
%ProgramFiles(x86)%\rstest.ini
%TEMP%\rav.cfg
%TEMP%\nsxc10f.tmp\baidu_com_90000294.exe
%TEMP%\rspcver12.xml
%TEMP%\nsxc10f.tmp\base64.dll
%TEMP%\nsxc10f.tmp\duba_1_219.exe
%TEMP%\nsxc10f.tmp\execcmd.dll
%TEMP%\nsxc10f.tmp\inetc.dll
%TEMP%\nsxc10f.tmp\install1078565.exe
%TEMP%\nsxc10f.tmp\nsisdl.dll
%TEMP%\nsxc10f.tmp\sohuva_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
%TEMP%\nsxc10f.tmp\system.dll

Moves the following files

from %TEMP%\rsdsfxtmp\license\12345678.000 to %TEMP%\rsdsfxtmp\license\12345678.000.bak
from %TEMP%\rav.cfg to %TEMP%\rav.cfg.bak
from %TEMP%\rspcver12.xml.rs to %TEMP%\rspcver12.xml

Substitutes the following files

%TEMP%\rsdsfxtmp\license\12345678.000
%TEMP%\rav.cfg
%TEMP%\rav.cfg.tmp

Network activity

Connects to

'pv.#ohu.com':80
'si#####ck2.opera.com':80
'en.###ipedia.org':443
'se####.yahoo.com':443
'en.###ipedia.org':80
'am##on.com':443
'bing.com':80
'am##on.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':443
'au######te.geo.opera.com':80
'cl###.rising.com.cn':80
'10#####-1.vod.tv.itc.cn':80
'da##.vod.itc.cn':80
'p2#.#d.sohu.com':80
'do####ad.2345.cn':80
'sh###.baidu.com':80
'rs####.rising.com.cn':80
'ce####.rising.com.cn':80
'do#####d.suxiazai.com':80
'ke##55.com':80
'd.###005.com':80
're###.opera.com':80
'cd###.www.duba.net':80

TCP

HTTP GET requests

http://pv.#ohu.com/cityjson
http://si#####ck2.opera.com/?ho###################################################
http://si#####ck2.opera.com/?ho#####################################################
http://en.###ipedia.org/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://se####.yahoo.com/favicon.ico
http://www.am##on.com/favicon.ico
http://www.google.com/favicon.ico
http://au######te.geo.opera.com/geolocation/
http://ce####.rising.com.cn/urg.asp?v=##
http://cl###.rising.com.cn/productstat/productStat.aspx?in#######################################################################################################################################...
http://10#####-1.vod.tv.itc.cn/sohu/ifox/LzEwMS8amBelPKkhq6mcq6SnKyUqMKqonDEaHLGjFzK8GUmZD0xMC/SoHuVA_7.1.9.0-c204900003-ng-nti-tp-s-x.exe
http://da##.vod.itc.cn/foxd/gz?fi#####################################################################################
http://p2#.#d.sohu.com/dcs.do?f=#################################
http://rs####.rising.com.cn/rs2012/RsPcVer12.xml
http://do####ad.2345.cn/silence/2345Explorer_329242_silence.exe
http://sh###.baidu.com/index/mini_2to1_download/90000294
http://rs####.rising.com.cn/Register/OnlineHelper/ForLog/ForLogDeve.aspx?In######################################################################################################################...
http://ce####.rising.com.cn/LogCenter.asp?in#####################################################################################################################################################...
http://do#####d.suxiazai.com/for_down/2013/install1078565.exe
http://www.ke##55.com/
http://d.###005.com/TG/KeLe2014Beta3.6.2Promote0326_20090195130.exe
http://re###.opera.com/www.opera.com/firstrun/
http://cd###.www.duba.net/duba/install/2011/ever/duba_1_219.exe

Other

'au######te.geo.opera.com':443
'du###uckgo.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443

UDP

DNS ASK pv.#ohu.com
DNS ASK cd###.www.duba.net
DNS ASK si#####ck2.opera.com
DNS ASK en.###ipedia.org
DNS ASK bing.com
DNS ASK bi##.#ikimedia.org
DNS ASK am##on.com
DNS ASK se####.yahoo.com
DNS ASK du###uckgo.com
DNS ASK au######te.geo.opera.com
DNS ASK google.com
DNS ASK cl###.rising.com.cn
DNS ASK 10#####-1.vod.tv.itc.cn
DNS ASK da##.vod.itc.cn
DNS ASK p2#.#d.sohu.com
DNS ASK da###.iruixing.com
DNS ASK do####ad.2345.cn
DNS ASK sh###.baidu.com
DNS ASK d.###oux.com
DNS ASK rs####.rising.com.cn
DNS ASK ce####.rising.com.cn
DNS ASK w.#.#aidu.com
DNS ASK j.##.baidu.com
DNS ASK do#####d.suxiazai.com
DNS ASK ke##55.com
DNS ASK d.###005.com
DNS ASK re###.opera.com
DNS ASK ch###xingbw.com

Miscellaneous

Searches for the following windows

ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\nsxc10f.tmp\install1078565.exe'
'%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.exe'
'%ProgramFiles(x86)%\rising\rsd\popwndexe.exe'
'%TEMP%\nsxc10f.tmp\sohuva_4.2.0.16-c204900003-ng-nti-tp-s-x.exe'
'%TEMP%\nsxc10f.tmp\duba_1_219.exe'
'%WINDIR%\syswow64\cmd.exe' /C copy /b "KeLe2014Beta3.6.2Promote0326_20090195130.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "KeLe2014Beta3.6.2Promote0326_20090195130.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C copy /b "Baidu_Com_90000294.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "Baidu_Com_90000294.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C copy /b "2345Explorer_329242_silence.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "2345Explorer_329242_silence.exe"' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavlog2.exe' -install' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe' /autorun /hidefloatwin /silentinstrcmd' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe' /start kxescore' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe' /autorun /std /skipcs3' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C copy /b "KeLe2014Beta3.6.2Promote0326_20090195130.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "KeLe2014Beta3.6.2Promote0326_20090195130.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.12.2114626267\1398049288" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.10.61424929\1447807056" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.9.190357736\405095228" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.8.214907031\2048621628" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.7.1592904319\827155111" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2824.4.916398386\1175308472" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=3616
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.5.698250801\1415592883" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.6.1297017300\1482671392" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.4.916398386\1175308472" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%WINDIR%\syswow64\cmd.exe' /C copy /b "2345Explorer_329242_silence.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "2345Explorer_329242_silence.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2824.0.758881320\890380987" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-...
'%WINDIR%\syswow64\cmd.exe' /C copy /b "Baidu_Com_90000294.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "Baidu_Com_90000294.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://changxingbw.com/bWx1ZXhubS5leGU=/40.html /crash-reporter-parent-id=2824
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://changxingbw.com/bWx1ZXhubS5leGU=/40.html
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://changxingbw.com/bWx1ZXhubS5leGU=/40.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.11.1518062205\214219131" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2824.15.1970340833\1442877211" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial