Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\nsua257.tmp\system.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\个性化首页.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\隐私保护.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\修复功能.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\垃圾清理.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\广告拦截.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\帮助指南.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\伴侣导航.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\屏蔽列表.url
- %ProgramFiles(x86)%\baidu\toolbar\barbroker.exe
- %ProgramFiles(x86)%\baidu\toolbar\rc.dll
- %ProgramFiles(x86)%\baidu\toolbar\baidubarx.dll
- %TEMP%\deltemp.bat
- %ProgramFiles(x86)%\baidu\toolbar\baidubarx_tmp\baidubarx.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\自定义按钮.url
- %TEMP%\nsub145.tmp
- %TEMP%\nsfaddc.tmp
- %HOMEPATH%\desktop\°ù¶èóîï·´óìü.lnk
- %TEMP%\nsua257.tmp\shelllink.dll
- %WINDIR%\newicon.ico
- %HOMEPATH%\favorites\====Гøö·ö®¼ò====.url
- %APPDATA%\microsoft\internet explorer\quick launch\1nternet explorer.lnk
- %HOMEPATH%\desktop\1nternet explorer.lnk
- %ProgramFiles%\qvod39\qvodex.dll
- %WINDIR%\ime\sptipimers.ini
- %TEMP%\baidu-toolbar-top1.exe
- %TEMP%\setup_000024.exe
- %TEMP%\max2_133daohang4.exe
- %TEMP%\besetup.exe
- %TEMP%\nsfae2b.tmp\inetload2.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\卸载百度工具栏.lnk
Deletes the following files
- %TEMP%\nsua257.tmp\shelllink.dll
- %TEMP%\nsua257.tmp\system.dll
- %TEMP%\nsfae2b.tmp\inetload2.dll
- %TEMP%\besetup.exe
Modifies the following files
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
- C:\users\public\desktop\firefox.lnk
Network activity
Connects to
- 'mk.##xthon.cn':80
TCP
HTTP GET requests
- http://mk.##xthon.cn/online_inst/data.ini
- http://mk.##xthon.cn/133daohang4/setup_133daohang4.exe
UDP
- DNS ASK do##.#amesbaidu.com
- DNS ASK mk.##xthon.cn
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\besetup.exe'
- '%TEMP%\max2_133daohang4.exe'
- '%TEMP%\setup_000024.exe'
- '%TEMP%\baidu-toolbar-top1.exe'
- '%ProgramFiles(x86)%\baidu\toolbar\barbroker.exe' -RegServer
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s C:\PROGRA~1\QVOD39\QvodEx.dll
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\DelTemp.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\DelTemp.bat" "' (with hidden window)
