Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'АЦїЙУ°КУ' = '%PROGRAM_FILES%\АЦїЙУ°КУ\play.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\nsn3.tmp\ns4.tmp' %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\dll.bat
Executes the following:
- '<SYSTEM32>\regsvr32.exe' QvodBand.dll -s
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\АЦїЙУ°КУ\qvod\dll.bat"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\tabs_left.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\tabs_fill.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\tabs_right.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\tabs_mid.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\tab1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\search_icon.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\search_botton.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\tab.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\stop.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\tabs_search_fill.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\volume.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\topright1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\volumep.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\volumeb.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\topright.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\top.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\tabs_search_left.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\topleft1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\topleft.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\scroll_up.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\progress_point_a.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\progress.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\progress_thumb.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\progress_point_b.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\processp.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\play.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\pause.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\pre.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\playlist_toolbar.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\reold.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\scroll_limit.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\scroll_left.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\scroll_right.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\scroll_limit_h.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\scroll_down.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\right1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\right.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\scroll_back_h.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\scroll_back.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Tip\view.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Tip\maintext.bmp
- <SYSTEM32>\s.ico
- <SYSTEM32>\i.ico
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Tip\close.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Tip\QvodTips.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Tip\QvodTip.exe
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Tip\back.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Tip\QvodTips_.xml
- %HOMEPATH%\Desktop\ЙПНшµјєЅ.url
- %HOMEPATH%\Start Menu\АЦїЙУ°КУ.lnk
- %HOMEPATH%\Desktop\АЦїЙУ°КУ.lnk
- %PROGRAM_FILES%\АЦїЙУ°КУ\uninst.exe
- %TEMP%\nsn3.tmp\System.dll
- %HOMEPATH%\Start Menu\Programs\АЦїЙУ°КУ\Р¶ФШАЦїЙУ°КУ.lnk
- %HOMEPATH%\Start Menu\ЙПНшµјєЅ.url
- %HOMEPATH%\Desktop\МФ±¦№єОп.url
- %HOMEPATH%\Start Menu\Programs\АЦїЙУ°КУ\АЦїЙУ°КУ.lnk
- %HOMEPATH%\Start Menu\МФ±¦№єОп.url
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Tip\PopMessage.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\mute2.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\mute.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\open.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\next.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\info.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Logo.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\back.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Mini.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\pause.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\volume.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\progressd.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\volumep.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\volumeb.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\progress_thumb.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\pre.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\play.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\progress.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\MiNi\processp.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Playlist\Channel.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Lang\zh_TW.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Playlist\Mediacenter.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Playlist\Keywords.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Lang\en_US.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Codecs\drvc.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Codecs\cook.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Codecs\raac.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Codecs\f4v.swf
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Playlist\Playlist.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\bgline.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\backright.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\bottom.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\bleft1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\backmid.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Playlist\Text.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Playlist\QvodSearch.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\backleft.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\back.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Codecs\atrc.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\QvodExtend.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\QvodCfg.ini
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\QvodPlayer.exe
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\QvodInsert.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\QvodBand.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\QvodInit.exe
- %TEMP%\nse2.tmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Qvod.cfg
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\NetAgent.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\QvodPlayer.xml
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Codecs\ColorFilter.ax
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\AddIn\VisLrc.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Codecs\asfsplliter.ax
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Codecs\RealMediaSplitter.ax
- %TEMP%\nsn3.tmp\ns4.tmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\ShareModule.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\QvodTerminal.exe
- %TEMP%\nsn3.tmp\nsExec.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\dll.bat
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\media_sham_2.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\media_sham.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\mediare.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\mediaeditdel.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\media_search.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\media_files_2.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\media_files.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\media_info.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\media_fill.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\mediatolist.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\next.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\mute2.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\open.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\nowplay.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\mute.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\menu.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\mediatree.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\mtk.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\min.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\media_del.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\icon.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\full.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\infofull.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\info.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\close.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\bottomright.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\bottomleft.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\caption.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\bright1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\left.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\lsearchbg.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\lsearchb2.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\max.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\lsearchbg1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\lsearchb1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\listbutton.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\left1.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\listsplit.bmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\Skin\Default\listbutton2.bmp
Deletes the following files:
- %TEMP%\nsn3.tmp\nsExec.dll
- %TEMP%\nsn3.tmp\System.dll
- %PROGRAM_FILES%\АЦїЙУ°КУ\uninst.exe
- %TEMP%\nsn3.tmp\ns4.tmp
- %PROGRAM_FILES%\АЦїЙУ°КУ\qvod\dll.bat
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
