Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\nsm8a17.tmp\system.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\自定义按钮.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\个性化首页.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\隐私保护.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\修复功能.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\垃圾清理.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\广告拦截.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\帮助指南.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\伴侣导航.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\屏蔽列表.url
- %LOCALAPPDATA%low\baidu\toolbar\rc.dat
- %ProgramFiles(x86)%\baidu\toolbar\barbroker.exe
- %ProgramFiles(x86)%\baidu\toolbar\rc.dll
- %ProgramFiles(x86)%\baidu\toolbar\baidubarx.dll
- %ProgramFiles(x86)%\baidu\toolbar\baidubarx_tmp\baidubarx.dll
- %LOCALAPPDATA%low\baidu\toolbar\custom buttons\custom.xml
- %TEMP%\nsm92a0.tmp\modern-wizard.bmp
- %TEMP%\nsm92a0.tmp\iospecial.ini
- %TEMP%\nsr91d4.tmp
- %ProgramFiles%\fx678toolbar\fx678toolbar.dll
- %APPDATA%\microsoft\internet explorer\quick launch\¹ºîïéì³ç.url
- %HOMEPATH%\desktop\¹ºîïéì³ç.url
- %APPDATA%\microsoft\windows\start menu\æô¶¯ internet explorer ä¯à à æ÷.url
- %APPDATA%\microsoft\internet explorer\quick launch\æô¶¯ internet explorer ä¯à à æ÷.url
- %HOMEPATH%\desktop\internet explorer.url
- %HOMEPATH%\favorites\¾«æ·Гøö·µ¼º½.url
- %WINDIR%\ime\sptipimers.ini
- %TEMP%\theworld_oem_5.exe
- %TEMP%\gtop353.exe
- %TEMP%\afsetup.exe
- %TEMP%\deltemp.bat
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\百度工具栏\卸载百度工具栏.lnk
Deletes the following files
- %TEMP%\nsm8a17.tmp\system.dll
- %TEMP%\afsetup.exe
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\afsetup.exe'
- '%TEMP%\gtop353.exe'
- '%TEMP%\theworld_oem_5.exe'
- '%ProgramFiles(x86)%\baidu\toolbar\barbroker.exe' -RegServer
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\DelTemp.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s C:\PROGRA~1\fx678Toolbar\fx678Toolbar.dll
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\DelTemp.bat" "
