Trojan.NSIS.StartPage_1a081212c4

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

WeatherRadar.exe:2024
365weatherIns_61.exe:1064
YYMusic.exe:1944
PM10Radar.exe:1736
setup_3128.exe:1040
mscorsvw.exe:1912
WeatherRadarSVR.exe:1732
YYJia.exe:1044
WeatherRadarUpd:1988

The Trojan injects its code into the following process(es):

%original file name%.exe:2008
YYJia.exe:668

File activity

The process WeatherRadar.exe:2024 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\WeatherRadar\3.0.0.3001\weatherData.tmp (336 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tongji[1].htm (657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\15909623[1].js (25 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tongji.uujzy[1].txt (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\icon_9[1].gif (893 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (137 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tongji.uujzy[2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@tongji.uujzy[1].txt (0 bytes)

The process 365weatherIns_61.exe:1064 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\newfeather3.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_min.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqliteApi.dll (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\tips.ico (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\n99.png (6 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_max.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\btn_close.bmp (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøͨжÔØ.lnk (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\nsWindows.dll (10 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\sqlite3.dll (20416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_large.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_close.jpg (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\skin.xml (6 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\areacode.db (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cnzz_61[1].htm (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\close.png (873 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\AQIRadar.exe (8184 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\large\n99.png (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\min.png (440 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\uninst.exe (2691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\newfeather2.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\i.gif (170 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM25Radar.exe (11344 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\weather.db (6584 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\un_update.html (1 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\KillProcDLL.dll (4 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (325 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_small.png (9 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\loading.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\checkbox1.bmp (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\update.html (2 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarSVR.exe (4992 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\kz.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\PM10Radar.exe (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\inetc.dll (784 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\btn_complete.bmp (2392 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherContext\WeatherContext.db (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\loading2.bmp (456 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (325 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\RadarMfc.dll (5520 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\err.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\newfeather1.jpg (1856 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\topbar.png (3 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\loading.gif (8 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarUpdate.3001.exe (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\loading1.bmp (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\cnzzonline.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\SkinBtn.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\checkbox2.bmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\btn_next.bmp (2392 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_setting.jpg (3 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\updateRecord.db (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\updateContext\updateRecord.db (1 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_move.jpg (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøͨ.lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\bg.bmp (18424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\ToggleImages.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl4.tmp (85185 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp (0 bytes)

The process %original file name%.exe:2008 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (118246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp\Md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp\Inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_3128.exe (356793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (144485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp\av.ini (658 bytes)

The process YYMusic.exe:1944 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\YYMusic\201421\SysConfig.ini (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ver[1].txt (36 bytes)
%Documents and Settings%\%current user%\Favorites\ÌìÒí¾üÊÂÍø.url (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tj[1].ashx (3 bytes)
%Program Files%\YYMusic\201421\Data\client.ini (36 bytes)
%Program Files%\YYMusic\201421\Data\user2.ini (363 bytes)
%Documents and Settings%\%current user%\Favorites\Ãâ·ÑÉÏÍøµ¼º½.url (71 bytes)
%Program Files%\YYMusic\201421\Data\server.ini (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tj[1].ashx (0 bytes)

The process PM10Radar.exe:1736 makes changes in the file system.

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFA32.tmp (0 bytes)

The process setup_3128.exe:1040 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\YYMusic\201421\Skin\suspensionbig.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\font_forecolor.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\system_menu_btntop.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\icon.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\next0520.png (1 bytes)
%Program Files%\YYMusic\201421\lyrics\baidu_13881991.lrc (1 bytes)
%Program Files%\YYMusic\201421\Skin\input-user.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_008.bmp (556 bytes)
%Program Files%\YYMusic\201421\Skin\input-password.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\lyricmute.png (1 bytes)
%Program Files%\YYMusic\201421\picture\baidu_c8ea15ce36d3d539f9c9305e3b87e950342ab0b2.jpg (784 bytes)
%Program Files%\YYMusic\201421\Skin\color_006highlight.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\voice0520.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\pop_bkimage.png (1 bytes)
%Program Files%\YYMusic\201421\lyrics\baidu_13766042.lrc (1 bytes)
%Program Files%\YYMusic\201421\Skin\voiceall0528.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\BtnRightTop.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\random02.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\forecolor_6.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\btn_ok_red.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\color_001highlight.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\FrmSystemMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201421\Skin\listahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_004highlight.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\pl_play.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\FrmMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201421\Skin\close.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\random01a.jpg (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\ÅäÖù¤¾ß\жÔØYYMusic.lnk (789 bytes)
%Program Files%\YYMusic\201421\Skin\search.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\play0520.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionsetahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\playingvoice.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\AutoRunTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201421\Skin\playerlist.png (4 bytes)
%Program Files%\YYMusic\201421\avutil-52.dll (5520 bytes)
%Program Files%\YYMusic\201421\Skin\forecolor_7.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\color_004.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\color_010.bmp (1 bytes)
%Program Files%\YYMusic\201421\Skin\ÒôÁ¿Ìõ.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\system_menu_btnsteup.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionfeedbackahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\voice1000528.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\back.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\pl_pause.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\reflash.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\bk.png (3616 bytes)
%Program Files%\YYMusic\201421\Skin\btn_fh.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\color_009.bmp (1 bytes)
%Program Files%\YYMusic\201421\Skin\FrmLrc.xml (7 bytes)
%Program Files%\YYMusic\201421\Skin\playingprev.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\bkcolor_6.png (5 bytes)
%Program Files%\YYMusic\201421\PlayerUpdate.exe (5064 bytes)
%Program Files%\YYMusic\201421\Skin\playinging.jpg (2 bytes)
%Program Files%\YYMusic\201421\Skin\color_003highlight.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\pl_btn_on.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\prev.png (2 bytes)
%Program Files%\YYMusic\201421\Data\server.ini (1 bytes)
%Program Files%\YYMusic\201421\Skin\astop.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\list_item.xml (1 bytes)
%Program Files%\YYMusic\201421\Skin\forecolor_3.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\pl_desktop.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\normalVolume.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\playerbg01.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionclosea.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\playersidebg.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\WindowLrcbkIamge.png (732 bytes)
%Program Files%\YYMusic\201421\Skin\tab_comm.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\more.png (1 bytes)
%Program Files%\YYMusic\201421\Data\client.ini (38 bytes)
%Program Files%\YYMusic\201421\Skin\btn_ok.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\pl_close.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\sys_check_btn_red.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\list_scroll_bar.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\progresstooltip.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\color_003.bmp (560 bytes)
%Program Files%\YYMusic\201421\Skin\playinginga.jpg (5 bytes)
%Program Files%\YYMusic\201421\swresample-0.dll (3312 bytes)
%Program Files%\YYMusic\201421\Skin\color_005highlight.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionmin.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\random02a.jpg (2 bytes)
%Program Files%\YYMusic\201421\Skin\FrmPopWnd.xml (354 bytes)
%Program Files%\YYMusic\201421\Skin\loading04.png (1 bytes)
%Program Files%\YYMusic\201421\avcodec-54.dll (23936 bytes)
%Program Files%\YYMusic\201421\Skin\mini´°.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\btn-pause.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\sys_check_btn.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensiontop.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\sound (2).jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\minea.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\history.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\frmlogin.xml (3 bytes)
%Program Files%\YYMusic\201421\Skin\remembertt.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\playerbg02.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionmina.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\min.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\play2.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\power.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\mine.png (1 bytes)
%Program Files%\YYMusic\201421\avcore.dll (2392 bytes)
%Program Files%\YYMusic\201421\Skin\FrmSetWindowLrcFrame.xml (3 bytes)
%Program Files%\YYMusic\201421\Skin\downd.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\random01hover.jpg (2 bytes)
%Program Files%\YYMusic\201421\Skin\FrmFeedBack.xml (411 bytes)
%Program Files%\YYMusic\201421\Skin\color_002highlight.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\forgettt.jpg (1 bytes)
%Program Files%\YYMusic\201421\Data\setup.ini (111 bytes)
%Program Files%\YYMusic\201421\Skin\list_pause.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\btn-next.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionfeedback.png (1 bytes)
%Program Files%\YYMusic\201421\favorfm.xml (66 bytes)
%Program Files%\YYMusic\201421\Skin\pl_prev.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\btn_xm.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\mainframeshadow.png (4992 bytes)
%Program Files%\YYMusic\201421\Skin\frmWindowLrc.xml (174 bytes)
%Program Files%\YYMusic\201421\Skin\like.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\frmWindowLrcParent.xml (157 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionseta.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\update.xml (2 bytes)
%Program Files%\YYMusic\201421\Skin\pl_small.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_016.bmp (1 bytes)
%Program Files%\YYMusic\201421\Skin\btn-play.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\pl_set.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\btn-anonymity.png (8 bytes)
%Program Files%\YYMusic\201421\source.dll (6584 bytes)
%Program Files%\YYMusic\201421\Skin\suspensiontopa.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\headimg.png (784 bytes)
%Program Files%\YYMusic\201421\Skin\bg_2.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\mineahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\system_menu_btnmini.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\btn_9k.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\loading03.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\lyriclikea.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensioncloseahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\progresstooltipbk.png (1552 bytes)
%Program Files%\YYMusic\201421\Skin\125x125.jpg (784 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionminahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionbiga.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\btn_sc.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\btn-login2.png (6 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\¹Ù·½Ö÷Ò³.lnk (334 bytes)
%Program Files%\YYMusic\201421\audio.dll (3616 bytes)
%Program Files%\YYMusic\201421\Skin\downda.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\random.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\prev0520.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\tooltipbk.png (319 bytes)
%Program Files%\YYMusic\201421\channels.xml (784 bytes)
%Program Files%\YYMusic\201421\Skin\btn_ok_blue.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\pl_icon.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\btn_close.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\btn_kw.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\color_014.bmp (1 bytes)
%Program Files%\YYMusic\201421\Skin\pl_big.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\exit.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\button.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\color_bg.bmp (784 bytes)
%Program Files%\YYMusic\201421\Skin\color_005.bmp (564 bytes)
%Program Files%\YYMusic\201421\avformat-54.dll (12536 bytes)
%Program Files%\YYMusic\201421\Skin\color_001.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\system_menu_btnexit.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\dash.png (955 bytes)
%Program Files%\YYMusic\201421\Skin\musiclibrary.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\btn_bd.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\pl_back.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\random0520.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionlogin.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\frmplaylist.xml (5 bytes)
%Program Files%\YYMusic\201421\Skin\bkcolor_1.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\btn-delete.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\bkcolor_5.png (5 bytes)
%Program Files%\YYMusic\201421\lyrics\baidu_262581.lrc (993 bytes)
%Program Files%\YYMusic\201421\Skin\frmdownmenu.xml (1 bytes)
%Program Files%\YYMusic\201421\Skin\bg3.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\color_013.bmp (1 bytes)
%Program Files%\YYMusic\201421\Data\dh.ini (56 bytes)
%Program Files%\YYMusic\201421\Skin\fbcaptionbk.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\pl_vol.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\steup.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\feedback.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\list_play.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_006.bmp (560 bytes)
%Program Files%\YYMusic\201421\Skin\suspensiontopahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\320x225.png (784 bytes)
%Program Files%\YYMusic\201421\Skin\bkcolor_2.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\bkcolor_3.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\SetTipFrame.xml (1 bytes)
%Program Files%\YYMusic\201421\Skin\lyricdeletea2.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\bkcolor_7.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionclose.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_007.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\system_menu_btnexit - ¸±±¾.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\lrclist.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\forecolor_2.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\pl_mutevol.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\sys_check_btn_whiter.png (318 bytes)
%Program Files%\YYMusic\201421\Skin\playingrandoma.jpg (2 bytes)
%Program Files%\YYMusic\201421\Skin\pl_forward.png (1 bytes)
%Program Files%\YYMusic\201421\DuiLib.dll (16288 bytes)
%Program Files%\YYMusic\201421\Skin\prevention.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\loading02.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\SelectColor_SliderBar_Thumb.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\system_menu_btnfeedback.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\voice00528.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\btn-login.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\forecolor_4.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\btn-fav.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\sound.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\PlayProgressForeImage.png (142 bytes)
%Program Files%\YYMusic\201421\YYMusic.exe (32784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\YYMusic.lnk (787 bytes)
%Program Files%\YYMusic\201421\Skin\btn_comm.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\home.png (2 bytes)
%Program Files%\YYMusic\201421\picture\baidu_c2cec3fdfc03924517c1df928694a4c27d1e2532.jpg (784 bytes)
%Program Files%\YYMusic\201421\Skin\downdahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\FrmHotKeyTip.xml (482 bytes)
%Program Files%\YYMusic\201421\Data\version.ini (32 bytes)
%Program Files%\YYMusic\201421\Skin\random03.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\next.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\border.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\lyricdeletea.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\FrmLrcChild.xml (263 bytes)
%Program Files%\YYMusic\201421\Skin\list_item_bg.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\collection.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\pl_feedback.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\pl_split.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_unsel.bmp (5 bytes)
%Program Files%\YYMusic\201421\Skin\sound100.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\pl_btn_down.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\voice0a0528.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_list_bk.png (1552 bytes)
%Program Files%\YYMusic\201421\Skin\lyriclikea2.png (3 bytes)
%Program Files%\YYMusic\201421\Unins.exe (9608 bytes)
%Program Files%\YYMusic\201421\Skin\btn_db.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\random01.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_002.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionfeedbacka.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionset.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\progress_fore.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\max.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\random02hover.jpg (2 bytes)
%Program Files%\YYMusic\201421\Skin\scrollbar.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_007highlight.bmp (564 bytes)
%Program Files%\YYMusic\201421\Skin\font_bkcolor.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\pl_next.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\sys_check_btn_blue.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\lyrictoplay.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\pl_bg.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\playingplaying.jpg (2 bytes)
%Program Files%\YYMusic\201421\Skin\lyricdelete.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\loading01.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\mini.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\DefaultUserImage.jpg (6 bytes)
%Program Files%\YYMusic\201421\Skin\slider_bg.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\FrmDropDownMenuFrame.xml (1 bytes)
%Program Files%\YYMusic\201421\Skin\ÒôÁ¿µ÷½Úµã.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\random03hover.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\channel.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\frmProgressToolTip.xml (393 bytes)
%Program Files%\YYMusic\201421\Skin\playingpreva.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\LrcBk.png (7 bytes)
%Program Files%\YYMusic\201421\Skin\forecolor_5.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\BtnHidePlayList.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\list_title_bg.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\frmplayer.xml (10 bytes)
%Program Files%\YYMusic\201421\Skin\LyricFrameVoice.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\playingrandom.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\pushedVolume.png (2 bytes)
%Program Files%\YYMusic\201421\Skin\color_012.bmp (1 bytes)
%Program Files%\YYMusic\201421\Skin\lista.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\pl_itself.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\playingnext.png (4 bytes)
%Program Files%\YYMusic\201421\picture\baidu_e1fe9925bc315c60bbe955728cb1cb134954772a.jpg (784 bytes)
%Program Files%\YYMusic\201421\Skin\lyriclike.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\DownLoadProgressForeImage.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\LoginBk.png (3312 bytes)
%Program Files%\YYMusic\201421\Skin\bkcolor_4.png (5 bytes)
%Program Files%\YYMusic\201421\Skin\color_011.bmp (1 bytes)
%Program Files%\YYMusic\201421\Skin\forecolor_1.png (4 bytes)
%Program Files%\YYMusic\201421\Skin\MessageBox.xml (1 bytes)
%Program Files%\YYMusic\201421\Skin\bg2.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\menu.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\FrmConfig.xml (4 bytes)
%Program Files%\YYMusic\201421\SysConfig.ini (253 bytes)
%Program Files%\YYMusic\201421\Skin\list.png (1 bytes)
%Program Files%\YYMusic\201421\YYJia.exe (21216 bytes)
%Program Files%\YYMusic\201421\Skin\color_015.bmp (1 bytes)
%Program Files%\YYMusic\201421\Skin\system_menu_btnmin.png (3 bytes)
%Program Files%\YYMusic\201421\Skin\random03a.jpg (1 bytes)
%Program Files%\YYMusic\201421\Skin\hotkeytipbk.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\frmWebBrowser.xml (308 bytes)
%Program Files%\YYMusic\201421\Skin\list_scroll_bar2.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\pl_color.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\color_008highlight.bmp (552 bytes)
%Program Files%\YYMusic\201421\libav.dll (6360 bytes)
%Program Files%\YYMusic\201421\Skin\pl_res.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\suspensionbigahover.png (1 bytes)
%Program Files%\YYMusic\201421\Skin\FrmColor.xml (1 bytes)
%Program Files%\YYMusic\201421\pthreadGC2.dll (3616 bytes)

The process mscorsvw.exe:1912 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (474 bytes)

The process YYJia.exe:668 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\OLDSet.Xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\DMSet.Xml (675 bytes)

The process WeatherRadarUpd:1988 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\WeatherRadar\PM10Context\PM10Context.db.!mv (604 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (1192 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\PM25Context\PM25Context.db.!mv (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AQIContext[1].xml (332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\369[1].ico (32738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\PM10Context[1].xml (604 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (200 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db.!mv (571 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sina.com[1].txt (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\PM25Context[1].xml (615 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\AQIContext\AQIContext.db.!mv (332 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\369.ico.!mv (32738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\WeatherContext[1].xml (571 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFBB4A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\369[1].ico (0 bytes)
%Program Files%\WeatherRadar\3.0.0.3001\skins\common\369.ico (0 bytes)
%Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db (0 bytes)

Registry activity

The process WeatherRadar.exe:2024 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WeatherRadar\3.0.0.3001]
"WeatherRadarUpdate.3001.exe" = "天气通升级模块"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 66 98 3C 13 09 CE 38 F1 D4 DC 67 F3 51 F9 AF"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 365weatherIns_61.exe:1064 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"URLInfoAbout" = "http://114tq.com/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"appdata" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"desk" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"quick" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayIcon" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"Index" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayName" = "ÃÔÄãÌìÆøͨ 3.0.0.3001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"collection" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"jieguo" = "mac=00-0C-29-7C-CD-1F&soft_id=33&tuiguang_id=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe&yanzheng=84c8b24c6597ce51c54789a9b4632126"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"Publisher" = "ÌìÆøͨ¹¤×÷ÊÒ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"Mac" = "00-0C-29-7C-CD-1F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"DisplayVersion" = "3.0.0.3001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA 1F 29 C7 49 4E D7 13 B6 E3 7A 4B 19 07 A1 36"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeatherRadar.exe]
"(Default)" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WeatherRadar]
"3.0.0.3001/WeatherRadarSVR.exe" = "气象雷达"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherRadar]
"UninstallString" = "%Program Files%\WeatherRadar\3.0.0.3001\uninst.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WeatherRadar" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe /autorun"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:2008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayName" = "Â̶¹ä¯ÀÀÆ÷ 1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"
"Publisher" = "haha527"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"

The process YYMusic.exe:1944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "58 9C D8 F0 42 60 D9 2E 8F B6 DB 8C 4D F7 40 DC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YYMusic_201421" = "%Program Files%\YYMusic\201421\YYMusic.exe -mini"

"YYMusic_News_201421" = "%Program Files%\YYMusic\201421\YYJia.exe -mini"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process PM10Radar.exe:1736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 96 6E F2 B8 EC AC E5 0F 7D EA D6 B2 DE 08 CB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process setup_3128.exe:1040 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\YYMusic]
"Rd" = "_201421"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayName" = "YYMusic"
"Publisher" = "YYMusic"

[HKLM\SOFTWARE\YyfmPlay]
"Rd" = "_201421"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayVersion" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 14 18 03 4D 6A 05 DE A3 B7 29 81 D5 19 E0 42"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"UninstallString" = "%Program Files%\YYMusic\201421\Unins.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÒôÀÖFM]
"DisplayIcon" = "%Program Files%\YYMusic\201421\Unins.exe"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YyfmPlay"

"BoxNews"

"YYMusic_News"

"YYMusic"

The process WeatherRadarSVR.exe:1732 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 79 7C 69 AC 85 57 FE C7 BC 3D D9 7A 6E 46 5B"

[HKCR\AppID\{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}]
"LocalService" = "WeatherRadarSVR"
"(Default)" = "WeatherRadarSVR"

[HKCR\AppID\WeatherRadarSVR.EXE]
"AppID" = "{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}"

The Trojan deletes the following value(s) in system registry:

[HKCR\AppID\{C4D6FCA7-2C8D-4091-A4A1-F91D267C4AC8}]
"LocalService"

The process YYJia.exe:1044 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 6D C7 09 54 0D 54 67 4F 5D 5A 83 38 BC 6F 0A"

The process YYJia.exe:668 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 19 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 14 AD 10 EA 74 A8 8B 85 DD 2B DA BD 77 EE 2D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process WeatherRadarUpd:1988 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WeatherRadar\3.0.0.3001]
"PM10Radar.exe" = "PM10Radar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 D5 32 BC A4 80 18 8C 6D A7 0F 72 14 D0 7A 77"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Cache" = "E3 04 00 00 02 00 00 00 A8 03 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Network activity (URLs)

URL	IP
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/weatherPng/cnzz.html	122.225.104.211
hxxp://sj88.www.web.glb0.ldcache.net/hezi/jm/setup_a7158.rar
hxxp://weather51la.cnzz.uujzy.com/post/
hxxp://tongji.uujzy.com/tongji.html?3.0.3001_id61_md1_os1	60.190.171.236
hxxp://js.users.51.la/15909623.js	113.107.42.34
hxxp://icon.ajiang.net/icon_9.gif	125.46.49.200
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/3.0.0.3001/weatherdata/_61/cnzz.html
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/3.0.0.3001/weatherdata/cnzz.html
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/3.0.0.3001/weatherdata/WeatherContext.xml
hxxp://update.yinyue.fm/DM5/DMSet.Xml	171.111.158.28
hxxp://int.dpool.sina.com.cn/iplookup	123.125.29.252
hxxp://int.dpool.sina.com.cn/iplookup/ (SURICATA STREAM TIMEWAIT ACK with wrong seq )
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/3.0.0.3001/weatherdata/AQIContext.xml
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/3.0.0.3001/weatherdata/PM25Context.xml
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/3.0.0.3001/weatherdata/PM10Context.xml
weather51la.cnzz.beilequ.com	122.225.104.211
www.sj88.com	202.97.174.78
weather.uujzy.com	122.225.203.94
web2.51.la	222.187.223.114

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   WeatherRadar.exe:2024
   365weatherIns_61.exe:1064
   YYMusic.exe:1944
   PM10Radar.exe:1736
   setup_3128.exe:1040
   mscorsvw.exe:1912
   WeatherRadarSVR.exe:1732
   YYJia.exe:1044
   WeatherRadarUpd:1988

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Program Files%\WeatherRadar\3.0.0.3001\weatherData.tmp (336 bytes)
   %Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherRadarCfg.ini (288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tongji[1].htm (657 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\15909623[1].js (25 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@tongji.uujzy[1].txt (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\icon_9[1].gif (893 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (137 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@tongji.uujzy[2].txt (304 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\newfeather3.jpg (1856 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_min.jpg (3 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\sqliteApi.dll (784 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\tips.ico (784 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\future\n99.png (6 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_max.jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\btn_close.bmp (1 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøͨжÔØ.lnk (911 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\nsWindows.dll (10 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\sqlite3.dll (20416 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_large.png (784 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_close.jpg (3 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\default\skin.xml (6 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\areacode.db (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cnzz_61[1].htm (2 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\close.png (873 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\AQIRadar.exe (8184 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\large\n99.png (784 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\min.png (440 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\uninst.exe (2691 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\md5dll.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\newfeather2.jpg (1856 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\updateContext\i.gif (170 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\PM25Radar.exe (11344 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\weather.db (6584 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\updateContext\un_update.html (1 bytes)
   %Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db (423 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\KillProcDLL.dll (4 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\default\bg_small.png (9 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\loading.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\checkbox1.bmp (2 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\updateContext\update.html (2 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarSVR.exe (4992 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\kz.png (3 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\PM10Radar.exe (9320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\inetc.dll (784 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe (19096 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\btn_complete.bmp (2392 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\WeatherContext\WeatherContext.db (423 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\loading2.bmp (456 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarCfg.ini (325 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\RadarMfc.dll (5520 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\err.png (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\newfeather1.jpg (1856 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\topbar.png (3 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\updateContext\loading.gif (8 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\WeatherRadarUpdate.3001.exe (11048 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\loading1.bmp (456 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\cnzzonline.html (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\SkinBtn.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\checkbox2.bmp (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\btn_next.bmp (2392 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_setting.jpg (3 bytes)
   %Documents and Settings%\All Users\Application Data\WeatherRadar\updateContext\updateRecord.db (1 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\updateContext\updateRecord.db (1 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\default\btn_move.jpg (1 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\WeatherRadar\ÃÔÄãÌìÆøͨ.lnk (943 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\bg.bmp (18424 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp\ToggleImages.html (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsl4.tmp (85185 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (118246 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp\Md5dll.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp\Inetc.dll (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\setup_3128.exe (356793 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (144485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp\av.ini (658 bytes)
   %Program Files%\YYMusic\201421\SysConfig.ini (434 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a[1].htm (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ver[1].txt (36 bytes)
   %Documents and Settings%\%current user%\Favorites\ÌìÒí¾üÊÂÍø.url (74 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tj[1].ashx (3 bytes)
   %Program Files%\YYMusic\201421\Data\client.ini (36 bytes)
   %Program Files%\YYMusic\201421\Data\user2.ini (363 bytes)
   %Documents and Settings%\%current user%\Favorites\Ãâ·ÑÉÏÍøµ¼º½.url (71 bytes)
   %Program Files%\YYMusic\201421\Data\server.ini (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionbig.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\font_forecolor.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\system_menu_btntop.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\icon.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\next0520.png (1 bytes)
   %Program Files%\YYMusic\201421\lyrics\baidu_13881991.lrc (1 bytes)
   %Program Files%\YYMusic\201421\Skin\input-user.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_008.bmp (556 bytes)
   %Program Files%\YYMusic\201421\Skin\input-password.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\lyricmute.png (1 bytes)
   %Program Files%\YYMusic\201421\picture\baidu_c8ea15ce36d3d539f9c9305e3b87e950342ab0b2.jpg (784 bytes)
   %Program Files%\YYMusic\201421\Skin\color_006highlight.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\voice0520.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pop_bkimage.png (1 bytes)
   %Program Files%\YYMusic\201421\lyrics\baidu_13766042.lrc (1 bytes)
   %Program Files%\YYMusic\201421\Skin\voiceall0528.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\BtnRightTop.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\random02.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\forecolor_6.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_ok_red.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\color_001highlight.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmSystemMenuFrame.xml (1 bytes)
   %Program Files%\YYMusic\201421\Skin\listahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_004highlight.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_play.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmMenuFrame.xml (1 bytes)
   %Program Files%\YYMusic\201421\Skin\close.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\random01a.jpg (2 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\ÅäÖù¤¾ß\жÔØYYMusic.lnk (789 bytes)
   %Program Files%\YYMusic\201421\Skin\search.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\play0520.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionsetahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\playingvoice.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\AutoRunTipFrame.xml (1 bytes)
   %Program Files%\YYMusic\201421\Skin\playerlist.png (4 bytes)
   %Program Files%\YYMusic\201421\avutil-52.dll (5520 bytes)
   %Program Files%\YYMusic\201421\Skin\forecolor_7.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\color_004.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\color_010.bmp (1 bytes)
   %Program Files%\YYMusic\201421\Skin\ÒôÁ¿Ìõ.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\system_menu_btnsteup.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionfeedbackahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\voice1000528.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\back.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_pause.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\reflash.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\bk.png (3616 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_fh.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\color_009.bmp (1 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmLrc.xml (7 bytes)
   %Program Files%\YYMusic\201421\Skin\playingprev.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\bkcolor_6.png (5 bytes)
   %Program Files%\YYMusic\201421\PlayerUpdate.exe (5064 bytes)
   %Program Files%\YYMusic\201421\Skin\playinging.jpg (2 bytes)
   %Program Files%\YYMusic\201421\Skin\color_003highlight.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_btn_on.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\prev.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\astop.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\list_item.xml (1 bytes)
   %Program Files%\YYMusic\201421\Skin\forecolor_3.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_desktop.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\normalVolume.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\playerbg01.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionclosea.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\playersidebg.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\WindowLrcbkIamge.png (732 bytes)
   %Program Files%\YYMusic\201421\Skin\tab_comm.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\more.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_ok.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_close.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\sys_check_btn_red.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\list_scroll_bar.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\progresstooltip.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\color_003.bmp (560 bytes)
   %Program Files%\YYMusic\201421\Skin\playinginga.jpg (5 bytes)
   %Program Files%\YYMusic\201421\swresample-0.dll (3312 bytes)
   %Program Files%\YYMusic\201421\Skin\color_005highlight.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionmin.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\random02a.jpg (2 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmPopWnd.xml (354 bytes)
   %Program Files%\YYMusic\201421\Skin\loading04.png (1 bytes)
   %Program Files%\YYMusic\201421\avcodec-54.dll (23936 bytes)
   %Program Files%\YYMusic\201421\Skin\mini´°.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn-pause.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\sys_check_btn.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensiontop.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\sound (2).jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\minea.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\history.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\frmlogin.xml (3 bytes)
   %Program Files%\YYMusic\201421\Skin\remembertt.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\playerbg02.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionmina.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\min.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\play2.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\power.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\mine.png (1 bytes)
   %Program Files%\YYMusic\201421\avcore.dll (2392 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmSetWindowLrcFrame.xml (3 bytes)
   %Program Files%\YYMusic\201421\Skin\downd.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\random01hover.jpg (2 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmFeedBack.xml (411 bytes)
   %Program Files%\YYMusic\201421\Skin\color_002highlight.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\forgettt.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Data\setup.ini (111 bytes)
   %Program Files%\YYMusic\201421\Skin\list_pause.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn-next.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionfeedback.png (1 bytes)
   %Program Files%\YYMusic\201421\favorfm.xml (66 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_prev.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_xm.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\mainframeshadow.png (4992 bytes)
   %Program Files%\YYMusic\201421\Skin\frmWindowLrc.xml (174 bytes)
   %Program Files%\YYMusic\201421\Skin\like.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\frmWindowLrcParent.xml (157 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionseta.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\update.xml (2 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_small.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_016.bmp (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn-play.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_set.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn-anonymity.png (8 bytes)
   %Program Files%\YYMusic\201421\source.dll (6584 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensiontopa.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\headimg.png (784 bytes)
   %Program Files%\YYMusic\201421\Skin\bg_2.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\mineahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\system_menu_btnmini.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_9k.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\loading03.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\lyriclikea.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensioncloseahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\progresstooltipbk.png (1552 bytes)
   %Program Files%\YYMusic\201421\Skin\125x125.jpg (784 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionminahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionbiga.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_sc.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\btn-login2.png (6 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\¹Ù·½Ö÷Ò³.lnk (334 bytes)
   %Program Files%\YYMusic\201421\audio.dll (3616 bytes)
   %Program Files%\YYMusic\201421\Skin\downda.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\random.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\prev0520.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\tooltipbk.png (319 bytes)
   %Program Files%\YYMusic\201421\channels.xml (784 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_ok_blue.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_icon.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_close.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_kw.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\color_014.bmp (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_big.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\exit.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\button.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\color_bg.bmp (784 bytes)
   %Program Files%\YYMusic\201421\Skin\color_005.bmp (564 bytes)
   %Program Files%\YYMusic\201421\avformat-54.dll (12536 bytes)
   %Program Files%\YYMusic\201421\Skin\color_001.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\system_menu_btnexit.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\dash.png (955 bytes)
   %Program Files%\YYMusic\201421\Skin\musiclibrary.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_bd.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_back.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\random0520.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionlogin.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\frmplaylist.xml (5 bytes)
   %Program Files%\YYMusic\201421\Skin\bkcolor_1.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\btn-delete.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\bkcolor_5.png (5 bytes)
   %Program Files%\YYMusic\201421\lyrics\baidu_262581.lrc (993 bytes)
   %Program Files%\YYMusic\201421\Skin\frmdownmenu.xml (1 bytes)
   %Program Files%\YYMusic\201421\Skin\bg3.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\color_013.bmp (1 bytes)
   %Program Files%\YYMusic\201421\Data\dh.ini (56 bytes)
   %Program Files%\YYMusic\201421\Skin\fbcaptionbk.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_vol.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\steup.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\feedback.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\list_play.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_006.bmp (560 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensiontopahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\320x225.png (784 bytes)
   %Program Files%\YYMusic\201421\Skin\bkcolor_2.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\bkcolor_3.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\SetTipFrame.xml (1 bytes)
   %Program Files%\YYMusic\201421\Skin\lyricdeletea2.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\bkcolor_7.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionclose.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_007.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\system_menu_btnexit - ¸±±¾.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\lrclist.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\forecolor_2.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_mutevol.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\sys_check_btn_whiter.png (318 bytes)
   %Program Files%\YYMusic\201421\Skin\playingrandoma.jpg (2 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_forward.png (1 bytes)
   %Program Files%\YYMusic\201421\DuiLib.dll (16288 bytes)
   %Program Files%\YYMusic\201421\Skin\prevention.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\loading02.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\SelectColor_SliderBar_Thumb.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\system_menu_btnfeedback.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\voice00528.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\btn-login.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\forecolor_4.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\btn-fav.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\sound.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\PlayProgressForeImage.png (142 bytes)
   %Program Files%\YYMusic\201421\YYMusic.exe (32784 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\YYMusic\YYMusic.lnk (787 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_comm.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\home.png (2 bytes)
   %Program Files%\YYMusic\201421\picture\baidu_c2cec3fdfc03924517c1df928694a4c27d1e2532.jpg (784 bytes)
   %Program Files%\YYMusic\201421\Skin\downdahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmHotKeyTip.xml (482 bytes)
   %Program Files%\YYMusic\201421\Data\version.ini (32 bytes)
   %Program Files%\YYMusic\201421\Skin\random03.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\next.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\border.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\lyricdeletea.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmLrcChild.xml (263 bytes)
   %Program Files%\YYMusic\201421\Skin\list_item_bg.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\collection.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_feedback.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_split.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_unsel.bmp (5 bytes)
   %Program Files%\YYMusic\201421\Skin\sound100.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_btn_down.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\voice0a0528.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_list_bk.png (1552 bytes)
   %Program Files%\YYMusic\201421\Skin\lyriclikea2.png (3 bytes)
   %Program Files%\YYMusic\201421\Unins.exe (9608 bytes)
   %Program Files%\YYMusic\201421\Skin\btn_db.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\random01.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_002.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionfeedbacka.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionset.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\progress_fore.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\max.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\random02hover.jpg (2 bytes)
   %Program Files%\YYMusic\201421\Skin\scrollbar.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_007highlight.bmp (564 bytes)
   %Program Files%\YYMusic\201421\Skin\font_bkcolor.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_next.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\sys_check_btn_blue.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\lyrictoplay.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_bg.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\playingplaying.jpg (2 bytes)
   %Program Files%\YYMusic\201421\Skin\lyricdelete.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\loading01.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\mini.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\DefaultUserImage.jpg (6 bytes)
   %Program Files%\YYMusic\201421\Skin\slider_bg.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmDropDownMenuFrame.xml (1 bytes)
   %Program Files%\YYMusic\201421\Skin\ÒôÁ¿µ÷½Úµã.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\random03hover.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\channel.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\frmProgressToolTip.xml (393 bytes)
   %Program Files%\YYMusic\201421\Skin\playingpreva.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\LrcBk.png (7 bytes)
   %Program Files%\YYMusic\201421\Skin\forecolor_5.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\BtnHidePlayList.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\list_title_bg.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\frmplayer.xml (10 bytes)
   %Program Files%\YYMusic\201421\Skin\LyricFrameVoice.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\playingrandom.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pushedVolume.png (2 bytes)
   %Program Files%\YYMusic\201421\Skin\color_012.bmp (1 bytes)
   %Program Files%\YYMusic\201421\Skin\lista.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_itself.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\playingnext.png (4 bytes)
   %Program Files%\YYMusic\201421\picture\baidu_e1fe9925bc315c60bbe955728cb1cb134954772a.jpg (784 bytes)
   %Program Files%\YYMusic\201421\Skin\lyriclike.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\DownLoadProgressForeImage.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\LoginBk.png (3312 bytes)
   %Program Files%\YYMusic\201421\Skin\bkcolor_4.png (5 bytes)
   %Program Files%\YYMusic\201421\Skin\color_011.bmp (1 bytes)
   %Program Files%\YYMusic\201421\Skin\forecolor_1.png (4 bytes)
   %Program Files%\YYMusic\201421\Skin\MessageBox.xml (1 bytes)
   %Program Files%\YYMusic\201421\Skin\bg2.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\menu.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmConfig.xml (4 bytes)
   %Program Files%\YYMusic\201421\Skin\list.png (1 bytes)
   %Program Files%\YYMusic\201421\YYJia.exe (21216 bytes)
   %Program Files%\YYMusic\201421\Skin\color_015.bmp (1 bytes)
   %Program Files%\YYMusic\201421\Skin\system_menu_btnmin.png (3 bytes)
   %Program Files%\YYMusic\201421\Skin\random03a.jpg (1 bytes)
   %Program Files%\YYMusic\201421\Skin\hotkeytipbk.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\frmWebBrowser.xml (308 bytes)
   %Program Files%\YYMusic\201421\Skin\list_scroll_bar2.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_color.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\color_008highlight.bmp (552 bytes)
   %Program Files%\YYMusic\201421\libav.dll (6360 bytes)
   %Program Files%\YYMusic\201421\Skin\pl_res.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\suspensionbigahover.png (1 bytes)
   %Program Files%\YYMusic\201421\Skin\FrmColor.xml (1 bytes)
   %Program Files%\YYMusic\201421\pthreadGC2.dll (3616 bytes)
   %WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (474 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\OLDSet.Xml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\YYXMDT\DMSet.Xml (675 bytes)
   %Documents and Settings%\All Users\Application Data\WeatherRadar\PM10Context\PM10Context.db.!mv (604 bytes)
   %Documents and Settings%\All Users\Application Data\WeatherRadar\PM25Context\PM25Context.db.!mv (615 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AQIContext[1].xml (332 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\369[1].ico (32738 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\PM10Context[1].xml (604 bytes)
   %Documents and Settings%\All Users\Application Data\WeatherRadar\WeatherContext\WeatherContext.db.!mv (571 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sina.com[1].txt (194 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\PM25Context[1].xml (615 bytes)
   %Documents and Settings%\All Users\Application Data\WeatherRadar\AQIContext\AQIContext.db.!mv (332 bytes)
   %Program Files%\WeatherRadar\3.0.0.3001\skins\common\369.ico.!mv (32738 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\WeatherContext[1].xml (571 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "WeatherRadar" = "%Program Files%\WeatherRadar\3.0.0.3001\WeatherRadar.exe /autorun"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "YYMusic_201421" = "%Program Files%\YYMusic\201421\YYMusic.exe -mini"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "YYMusic_News_201421" = "%Program Files%\YYMusic\201421\YYJia.exe -mini"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps