Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\iyc6afile\shell\open\command] '' = '"%PROGRAM_FILES%\Microsoft Works\Common\7887\scqkmy.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\iyc6bfile\shell\open\command] '' = '"%PROGRAM_FILES%\Microsoft Works\Common\7887\scqkmy.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\iyc6file\shell\open\command] '' = '"%PROGRAM_FILES%\Microsoft Works\Common\7887\scqkmy.exe" "%1"'
Malicious functions:
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Start Menu\A超好玩的小游戏大全.url
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\7021.tmp
- %ALLUSERSPROFILE%\Start Menu\A绝色高清电影.url
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\9431.tmp
- %ALLUSERSPROFILE%\Desktop\A超好玩的小游戏大全.url
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\125.tmp
- %ALLUSERSPROFILE%\Desktop\A绝色高清电影.url
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\2600.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\C高清在线电影.url
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\83.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intrenet Explorere.url
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\947.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\B在线小游戏.url
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\943.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\A淘宝网-超值抢购.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ 显示桌面.iyc6b
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp781.bak
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ 我的电脑.iyc6a
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp960.bak
- %PROGRAM_FILES%\Internet Explorer\MUIE\iexplore.exe
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp432.bak
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ Intrenet Exqlorer.iyc6
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp264.bak
- %ALLUSERSPROFILE%\Desktop\Intrenet Exqlorer.iyc6
- %PROGRAM_FILES%\Microsoft Works\Common\7887\desktop.scf
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\1990.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp469.bak
- %ALLUSERSPROFILE%\Start Menu\Intrenet Exqlorer.iyc6
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp818.bak
- %ALLUSERSPROFILE%\Start Menu\Programs\Intrenet Exqlorer.iyc6
Deletes the following files:
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\7021.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\9431.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\125.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\2600.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\83.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\947.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\943.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp781.bak
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp960.bak
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp432.bak
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp264.bak
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\1990.tmp
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp469.bak
- %PROGRAM_FILES%\Microsoft Works\Common\7887\temp2\tmp818.bak
