Technical Information
Malicious functions:
Executes the following:
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.fi###tquick.com/quickbar/after_install.html
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Quick Bar\finditquick.com.dll"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\toolbar_users[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\after_install[1].html
- %PROGRAM_FILES%\Quick Bar\version.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\popup[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\popup[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\toolbar_users[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\version[1].txt
- %ALLUSERSPROFILE%\Application Data\{BFB5F154-9212-46F3-B547-AC6106030A54}\cache\82e73d5b4a9966ff636ceb89067c84bb
- %PROGRAM_FILES%\Quick Bar\tbhelper.dll
- %PROGRAM_FILES%\Quick Bar\autofill_plugin.dll
- %PROGRAM_FILES%\Quick Bar\basis.xml
- %TEMP%\nsw2.tmp
- %PROGRAM_FILES%\Quick Bar\autofill.cfg
- %PROGRAM_FILES%\Quick Bar\icons.bmp
- %PROGRAM_FILES%\Quick Bar\options.html
- %PROGRAM_FILES%\Quick Bar\finditquick.com.crc
- %PROGRAM_FILES%\Quick Bar\finditquick.com.dll
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\toolbar_users[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\popup[1].php
Moves the following files:
- from %PROGRAM_FILES%\Quick Bar\icons.bmp to %ALLUSERSPROFILE%\Application Data\{BFB5F154-9212-46F3-B547-AC6106030A54}\icons.bmp
- from %PROGRAM_FILES%\Quick Bar\options.html to %ALLUSERSPROFILE%\Application Data\{BFB5F154-9212-46F3-B547-AC6106030A54}\options.html
- from %PROGRAM_FILES%\Quick Bar\version.txt to %ALLUSERSPROFILE%\Application Data\{BFB5F154-9212-46F3-B547-AC6106030A54}\version.txt
- from %PROGRAM_FILES%\Quick Bar\autofill.cfg to %ALLUSERSPROFILE%\Application Data\{BFB5F154-9212-46F3-B547-AC6106030A54}\autofill.cfg
- from %PROGRAM_FILES%\Quick Bar\basis.xml to %ALLUSERSPROFILE%\Application Data\{BFB5F154-9212-46F3-B547-AC6106030A54}\basis.xml
- from %PROGRAM_FILES%\Quick Bar\finditquick.com.crc to %ALLUSERSPROFILE%\Application Data\{BFB5F154-9212-46F3-B547-AC6106030A54}\finditquick.com.crc
Network activity:
Connects to:
- 'fi###tquick.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- fi###tquick.com/quickbar/after_install.html
- fi###tquick.com/quickbar/install/version.txt
- fi###tquick.com/quickbar/toolbar_users.php
- fi###tquick.com/popup.php
UDP:
- DNS ASK www.fi###tquick.com
- DNS ASK fi###tquick.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
