Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\PlugPlay] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
blocks the following features:
- User Account Control (UAC)
Executes the following:
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.bmp\ShellNew /f
- '<SYSTEM32>\powercfg.exe' -h off
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.rar\ShellNew /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\Briefcase\ShellNew /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.zip\ShellNew /f
- '<SYSTEM32>\sc.exe' config Spooler start= DEMAND
- '<SYSTEM32>\sc.exe' config iphlpsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config SysMain start= DEMAND
- '<SYSTEM32>\sc.exe' config WSearch start= DISABLED
- '<SYSTEM32>\sc.exe' config WerSvc start= DISABLED
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.xdp\AcroExch.XDPDoc\ShellNew /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\RemovalTools\MRT /v "GUID" /t REG_SZ /d "0DFD22FD-39A9-4AD3-8789-25111F30F895" /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\RemovalTools\MRT /v "Version" /t REG_SZ /d "18C7629E-5F96-4BA8-A2C8-31810A54F5B8" /f
- '<SYSTEM32>\schtasks.exe' /delete /TN microsoft-windows-tabletpcinputpanel /F
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\cmd.exe' /c "%CommonProgramFiles%\Services\UQiRefresh.bat"
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.rtf\ShellNew /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.contact\ShellNew /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.zip\CompressedFolder\ShellNew /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\RemovalTools\MRT /v "EULA2" /t REG_DWORD /d "0x00000001" /f
- '%WINDIR%\regedit.exe' /s uqireg.reg
- '<SYSTEM32>\sc.exe' config MSDTC start= DISABLED
- '<SYSTEM32>\sc.exe' config iphlpsvc start= DISABLED
- '<SYSTEM32>\sc.exe' config MSiSCSI start= DISABLED
- '<SYSTEM32>\sc.exe' config PolicyAgent start= DISABLED
- '<SYSTEM32>\sc.exe' config Netlogon start= DISABLED
- '<SYSTEM32>\sc.exe' config AppMgmt start= DISABLED
- '<SYSTEM32>\cmd.exe' /c "%CommonProgramFiles%\Services\UQiOPfile.bat"
- '<SYSTEM32>\sc.exe' config CertPropSvc start= DISABLED
- '<SYSTEM32>\sc.exe' config fdPHost start= DISABLED
- '<SYSTEM32>\sc.exe' config DPS start= DISABLED
- '<SYSTEM32>\sc.exe' config seclogon start= DISABLED
- '<SYSTEM32>\sc.exe' config BITS start= DEMAND
- '<SYSTEM32>\sc.exe' config WebClient start= DISABLED
- '<SYSTEM32>\sc.exe' config PcaSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config PlugPlay start= AUTO
- '<SYSTEM32>\sc.exe' config WinDefend start= DISABLED
- '<SYSTEM32>\sc.exe' config swprv start= DEMAND
- '<SYSTEM32>\sc.exe' config SENS start= DISABLED
- '<SYSTEM32>\sc.exe' config TrkWks start= DISABLED
- '<SYSTEM32>\sc.exe' config WdiSystemHost start= DISABLED
- '<SYSTEM32>\sc.exe' config WdiServiceHost start= DISABLED
Forces autoplay for removable media.
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
- %HOMEPATH%\Favorites\课件园.url
- %TEMP%\autD.tmp
- %HOMEPATH%\Favorites\最佳导航 - BestURL.url
- %TEMP%\autC.tmp
- %HOMEPATH%\Favorites\优启时代.url
- %TEMP%\aut7.tmp
- %TEMP%\aut2.tmp
- %CommonProgramFiles%\Services\UQiOPfile.bat
- %TEMP%\aut1.tmp
- %CommonProgramFiles%\Services\uqireg.reg
- %TEMP%\aut3.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %CommonProgramFiles%\Services\UQiRefresh.bat
- %TEMP%\aut4.tmp
Deletes the following files:
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut7.tmp
- %TEMP%\autA.tmp
- %TEMP%\autD.tmp
- %TEMP%\autC.tmp
- %TEMP%\autB.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %CommonProgramFiles%\Services\uqireg.reg
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
