Adware.Downware.9500

Technical Information

Modifies file system

Creates the following files

%TEMP%\qs_142672b40\<File name>.log
%TEMP%\qs_142672b40\7zip_installer_9195.txt
%TEMP%\qs_142672b40\yahoo_keepmysettingsx.vi.zip
%TEMP%\qs_142672b40\yahoo_hpds_startpage.vi.zip
%TEMP%\qs_142672b40\yahoo_hpds_defaultsearch.vi.zip
%TEMP%\qs_142672b40\uninstallhelper.vi.zip
%TEMP%\qs_142672b40\driverscanner.vi.zip
%TEMP%\qs_142672b40\driverfighter.vi.zip
%TEMP%\qs_142672b40\kaspersky.vi.zip
%TEMP%\qs_142672b40\defaulttab.vi.zip
%TEMP%\qs_142672b40\pcspeedup.vi.zip
%TEMP%\qs_142672b40\fulldiskfighter.vi.zip
%TEMP%\qs_142672b40\pricegong.vi.zip
%TEMP%\qs_142672b40\savevalet.vi.zip
%TEMP%\qs_142672b40\offerbox.vi.zip
%TEMP%\qs_142672b40\smartdriverupdater.vi.zip
%TEMP%\qs_142672b40\omigaplus.vi.zip
%TEMP%\qs_142672b40\speedupmypc_sales_r2_v2.vi.zip
%TEMP%\symccis2.zip
%TEMP%\symccis.dll
%TEMP%\ccdd77b.tmp-shm
%TEMP%\ccdd77b.tmp
%LOCALAPPDATA%low\cookie.ini
%APPDATA%\microsoft\windows\ietldcache\low\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\57ozb1op\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xeietnsg\desktop.ini
%TEMP%\qs_142672b40\severeweatheralerts.vi.zip
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\lf4ejp1v\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%low\cookieman.exe
%TEMP%\qs_142672b40\sweetpage.vi.zip
%TEMP%\qs_142672b40\winferno.vi.zip
%TEMP%\qs_142672b40\surfcanyon.vi.zip
%TEMP%\qs_142672b40\nortonsecurityscan.vi.zip
%TEMP%\qs_142672b40\knctr.vi.zip
%TEMP%\qs_142672b40\rockettab.vi.zip
%TEMP%\qs_142672b40\arcadeparlor.vi.zip
%TEMP%\qs_142672b40\genieo.vi.zip
%TEMP%\qs_142672b40\muvic.vi.zip
%TEMP%\qs_142672b40\customsearchplus.vi.zip
%TEMP%\qs_142672b40\vebasearch.vi.zip
%TEMP%\qs_142672b40\yahoo_hpds_defaultsearch.test.vi.zip
%TEMP%\qs_142672b40\yahoo_hpds_startpage.test.vi.zip
%TEMP%\qs_142672b40\yahoosuite.vi.zip
%TEMP%\qs_142672b40\7zip.vi.zip
%TEMP%\qs_142672b40\darkux_3step_r2_v2.vi.zip
%TEMP%\qs_142672b40\config.xml
%TEMP%\qs_142672b40\nortoninternetsecurity.vi.zip
%TEMP%\qs_142672b40\pcoptimizerpro.vi.zip
%TEMP%\qs_142672b40\nortonantivirus.vi.zip
%TEMP%\qs_142672b40\savedailydeals.vi.zip
%TEMP%\qs_142672b40\weatherbug.vi.zip
%TEMP%\qs_142672b40\blitzmediaplayeroffer.vi.zip
%TEMP%\qs_142672b40\maxthon.vi.zip
%TEMP%\qs_142672b40\secureweb.vi.zip
%TEMP%\qs_142672b40\smartpccleaner.vi.zip
%TEMP%\qs_142672b40\mypcbackup.vi.zip
%TEMP%\qs_142672b40\slowpcfighter.vi.zip
%TEMP%\qs_142672b40\registryhelper.vi.zip
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\smutkug2\desktop.ini
%TEMP%\ccdd77b.tmp-wal
%TEMP%\qs_142672b40\resultsbay.vi.zip
%TEMP%\qs_142672b40\searchdonkey.vi.zip
%TEMP%\qs_142672b40\truedownloader.vi.zip
%TEMP%\qs_142672b40\wecarecleanwater.vi.zip
%TEMP%\qs_142672b40\driversupport.vi.zip
%TEMP%\qs_142672b40\contentexplorer.vi.zip
%TEMP%\qs_142672b40\seaapp.vi.zip
%TEMP%\qs_142672b40\jenkatgamesarcadeplus.vi.zip
%TEMP%\ccdd8b4.tmp

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\lf4ejp1v\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xeietnsg\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\smutkug2\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\57ozb1op\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files