Adware.Downware.9845

Technical Information

Modifies file system

Creates the following files

%TEMP%\qs_171263810\<File name>.log
%TEMP%\qs_171263810\pricegong.vi.zip
%TEMP%\qs_171263810\fulldiskfighter.vi.zip
%TEMP%\qs_171263810\pcspeedup.vi.zip
%TEMP%\qs_171263810\defaulttab.vi.zip
%TEMP%\qs_171263810\kaspersky.vi.zip
%TEMP%\qs_171263810\driverfighter.vi.zip
%TEMP%\qs_171263810\driverscanner.vi.zip
%TEMP%\qs_171263810\jenkatgamemanager.vi.zip
%TEMP%\qs_171263810\yahoo_hpds_defaultsearch.vi.zip
%TEMP%\qs_171263810\yahoo_hpds_startpage.vi.zip
%TEMP%\qs_171263810\nuancepdf_9389.txt
%LOCALAPPDATA%low\cookieman.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%TEMP%\ccd8085.tmp
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ah26ofiy\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\l08q3uuy\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\a572izbt\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\m5wm892m\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\ietldcache\low\index.dat
%LOCALAPPDATA%low\cookie.ini
%TEMP%\ccd7e05.tmp
%TEMP%\ccd7e05.tmp-shm
%TEMP%\ccd7e05.tmp-wal
%TEMP%\qs_171263810\offerbox.vi.zip
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%TEMP%\qs_171263810\smartdriverupdater.vi.zip
%TEMP%\qs_171263810\surfcanyon.vi.zip
%TEMP%\qs_171263810\config.xml
%TEMP%\qs_171263810\darkux_3step_v4.vi.zip
%TEMP%\qs_171263810\nuancepdf.vi.zip
%TEMP%\qs_171263810\yahoosuite.vi.zip
%TEMP%\qs_171263810\customsearchplus.vi.zip
%TEMP%\qs_171263810\muvic.vi.zip
%TEMP%\qs_171263810\genieo.vi.zip
%TEMP%\qs_171263810\arcadeparlor.vi.zip
%TEMP%\qs_171263810\browsersafeguard.vi.zip
%TEMP%\qs_171263810\savevalet.vi.zip
%TEMP%\qs_171263810\knctr.vi.zip
%TEMP%\qs_171263810\pcoptimizerpro.vi.zip
%TEMP%\qs_171263810\savedailydeals.vi.zip
%TEMP%\qs_171263810\tidynetwork.vi.zip
%TEMP%\qs_171263810\winferno.vi.zip
%TEMP%\qs_171263810\contentexplorer.vi.zip
%TEMP%\qs_171263810\yahoo_hpds_defaultsearch.test.vi.zip
%TEMP%\qs_171263810\blitzmediaplayeroffer.vi.zip
%TEMP%\qs_171263810\wecarecleanwater.vi.zip
%TEMP%\qs_171263810\yahoo_hpds_startpage.test.vi.zip
%TEMP%\qs_171263810\searchdonkey.vi.zip
%TEMP%\qs_171263810\severeweatheralerts.vi.zip
%TEMP%\qs_171263810\registryhelper.vi.zip
%TEMP%\qs_171263810\slowpcfighter.vi.zip
%TEMP%\qs_171263810\mypcbackup.vi.zip
%TEMP%\qs_171263810\smartpccleaner.vi.zip
%TEMP%\qs_171263810\secureweb.vi.zip
%TEMP%\qs_171263810\weatherbug.vi.zip
%TEMP%\qs_171263810\speedupmypc_sales_r2_v2.vi.zip
%TEMP%\qs_171263810\ping.response.json

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ah26ofiy\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\l08q3uuy\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\a572izbt\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\m5wm892m\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files