Adware.Downware.12570

Technical Information

Modifies file system

Creates the following files

%TEMP%\qs_171d2d3ce0\<File name>.log
%TEMP%\qs_171d2d3ce0\offerbox.vi.zip
%TEMP%\qs_171d2d3ce0\pricegong.vi.zip
%TEMP%\qs_171d2d3ce0\fulldiskfighter.vi.zip
%TEMP%\qs_171d2d3ce0\pcspeedup.vi.zip
%TEMP%\qs_171d2d3ce0\defaulttab.vi.zip
%TEMP%\qs_171d2d3ce0\kaspersky.vi.zip
%TEMP%\qs_171d2d3ce0\driverfighter.vi.zip
%TEMP%\qs_171d2d3ce0\driverscanner.vi.zip
%TEMP%\qs_171d2d3ce0\jenkatgamemanager.vi.zip
%TEMP%\qs_171d2d3ce0\yahoo_hpds_defaultsearch.vi.zip
%TEMP%\qs_171d2d3ce0\yahoo_hpds_startpage.vi.zip
%TEMP%\qs_171d2d3ce0\musicoasis_9143.txt
%LOCALAPPDATA%low\cookieman.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0kcdxscj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\y4qwrpps\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\2z9y9kqi\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ul8th6fn\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\ietldcache\low\index.dat
%LOCALAPPDATA%low\cookie.ini
%TEMP%\ccd6e0e.tmp
%TEMP%\ccd6e0e.tmp-shm
%TEMP%\ccd6e0e.tmp-wal
%TEMP%\qs_171d2d3ce0\smartdriverupdater.vi.zip
%TEMP%\ccd6f95.tmp
%TEMP%\qs_171d2d3ce0\speedupmypc_sales_r2_v2.vi.zip
%TEMP%\qs_171d2d3ce0\surfcanyon.vi.zip
%TEMP%\qs_171d2d3ce0\config.xml
%TEMP%\qs_171d2d3ce0\darkux_3step_v1.vi.zip
%TEMP%\qs_171d2d3ce0\musicoasis.vi.zip
%TEMP%\qs_171d2d3ce0\yahoosuite.vi.zip
%TEMP%\qs_171d2d3ce0\customsearchplus.vi.zip
%TEMP%\qs_171d2d3ce0\muvic.vi.zip
%TEMP%\qs_171d2d3ce0\genieo.vi.zip
%TEMP%\qs_171d2d3ce0\arcadeparlor.vi.zip
%TEMP%\qs_171d2d3ce0\browsersafeguard.vi.zip
%TEMP%\qs_171d2d3ce0\rrsavings.vi.zip
%TEMP%\qs_171d2d3ce0\websparkle.vi.zip
%TEMP%\qs_171d2d3ce0\showpass.vi.zip
%TEMP%\qs_171d2d3ce0\savevalet.vi.zip
%TEMP%\qs_171d2d3ce0\pcoptimizerpro.vi.zip
%TEMP%\qs_171d2d3ce0\savedailydeals.vi.zip
%TEMP%\qs_171d2d3ce0\contentexplorer.vi.zip
%TEMP%\qs_171d2d3ce0\yahoo_hpds_defaultsearch.test.vi.zip
%TEMP%\qs_171d2d3ce0\blitzmediaplayeroffer.vi.zip
%TEMP%\qs_171d2d3ce0\wecarecleanwater.vi.zip
%TEMP%\qs_171d2d3ce0\yahoo_hpds_startpage.test.vi.zip
%TEMP%\qs_171d2d3ce0\searchdonkey.vi.zip
%TEMP%\qs_171d2d3ce0\quatrocasinoca.vi.zip
%TEMP%\qs_171d2d3ce0\severeweatheralerts.vi.zip
%TEMP%\qs_171d2d3ce0\registryhelper.vi.zip
%TEMP%\qs_171d2d3ce0\slowpcfighter.vi.zip
%TEMP%\qs_171d2d3ce0\mypcbackup.vi.zip
%TEMP%\qs_171d2d3ce0\smartpccleaner.vi.zip
%TEMP%\qs_171d2d3ce0\secureweb.vi.zip
%TEMP%\qs_171d2d3ce0\weatherbug.vi.zip
%TEMP%\qs_171d2d3ce0\winferno.vi.zip
%TEMP%\qs_171d2d3ce0\ping.response.json

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0kcdxscj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\y4qwrpps\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\2z9y9kqi\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ul8th6fn\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files