Trojan.KillProc.16919

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\UUSEEREC\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeePlayer.exe" -v UUPlayer -url "%1"'
[<HKLM>\SOFTWARE\Classes\UUSEE\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeePlayer.exe" -v UUPlayer -url "%1"'
[<HKLM>\SOFTWARE\Classes\UUSEE.ucf\Shell\Open\Command] '' = '"%PROGRAM_FILES%\uusee\UUSeePlayer.exe" -file "%1"'
[<HKLM>\SOFTWARE\Classes\UUSEENOTIFY\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeePlayer.exe" -v UUPlayer -url "%1"'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{998A88A0-A355-809B-831C-B83A80000991}] 'Exec' = 'http://www.ugege.com/'
[<HKLM>\SOFTWARE\Classes\UUSEE\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeePlayer.exe" -url "%1"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UUSeeMediaCenter' = '"%CommonProgramFiles%\uusee\UUSeeMediaCenter.exe"'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{998A88A0-A355-809B-831C-B83A80000992}] 'Exec' = '%PROGRAM_FILES%\uusee\UUSeePlayer.exe'
[<HKLM>\SOFTWARE\Classes\uuupgrade\shell\open\command] '' = '"%CommonProgramFiles%\uusee\UUUpgrade.exe"'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\BITS] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\uusee\UUSeePlayer.exe' = '%PROGRAM_FILES%\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer'

Creates and executes the following:

%TEMP%\xinhezuo-uusee-1.exe /S
%PROGRAM_FILES%\Baidu\AddressBar\ASBarBroker.exe -RegServer
%CommonProgramFiles%\uusee\UUSeeMediaCenter.exe -handle 1114378
%PROGRAM_FILES%\uusee\UUSeePlayer.exe
%TEMP%\UUSEE_niuniu_Setup_152.exe
%TEMP%\Baidu-ASBar.exe
%TEMP%\UUSeeDownLoad.exe "C905A5494B8B7E6C8CC3E4873C3B676654E127CBA94C6CD8123FF70B6885A59DE3A5FD8F33555046542B807547518257D368A1E680A7B609EDCDE0A48EDB91B9U" "/S"
%TEMP%\GoogleToolbarInstaller_download_signed.exe /d:ask /h:ask /e:asknot /r:BJYN /q
%TEMP%\xinhezuo-uusee-1.exe (downloaded from the Internet)

Executes the following:

<SYSTEM32>\taskkill.exe /im GoogleToolbarInstaller_download_signed.exe /f

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Hot_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Icon0.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Hot_0.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_HScrollBar_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Header.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Icon1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ScrollBarThumb_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ScrollBarThumb_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Icon4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Icon2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Icon3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Expand3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_HScrollBarThumb_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Expand2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Collapse3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Expand.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_HScrollBarThumb_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_HScrollBar_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_HScrollBar_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_HScrollBar_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_HScrollBarThumb_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_HScrollBarThumb_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ScrollBarThumb_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Volume_Button_2_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_BK.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Volume_Button_2_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Volume_Bar_Block_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Volume_Button_2_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_ChannelInfo.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_ChatRoom_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Control_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_ChatRoom_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_ChannelInfo_5.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_ChatRoom_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ScrollBar_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ScrollBar_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ScrollBar_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ScrollBarThumb_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ScrollBar_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_SortIconDown.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Volume_Bar_Block_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Volume_Bar_Block_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\UUSEE.ui
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_SortIconUp.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\UUDEF_Buffering.jpg
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Collapse2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_5_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button5.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button9.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Startup.gif
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button8.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button6.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Side_Button7.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_3_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_3_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_2_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_2_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_2_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_3_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_5_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_5_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_4_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_4_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_4_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Switch_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_TopMost_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Toolbar_Button_FullScreen_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_TopMost_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_Res_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_TopMost_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Toolbar_Button_FullScreen_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_ArrowH.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Collapse.bmp
%TEMP%\Google Toolbar\BIT6.tmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Toolbar_Button_FullScreen_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Tree_Arrow.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Switch_C2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Switch_C3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Switch_C1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Switch_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Switch_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Thumbs.db
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_Res_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_Res_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_Compact_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_Compact_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Titlebar_button_Compact_2.bmp
%TEMP%\ROOT_UUPlayer.xml.zip
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\eng_uusee_2010.zip[1].html
%TEMP%\237046.7282
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\right_2010[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ROOT.zip[1].html
%TEMP%\240546.1689
%TEMP%\UUTV_STAT.xml.zip
%TEMP%\242140.571
%TEMP%\241812.6075
%PROGRAM_FILES%\uusee\def\UUDEF.xml.zip
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\UUTV_LIVE_HOT.zip[1].html
%PROGRAM_FILES%\uusee\def\UUDEF_Buffering.jpg
%PROGRAM_FILES%\uusee\def\UUDEF_Buffering.html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\float_2010[1].html
%PROGRAM_FILES%\uusee\UUTV_LIB.XML
%PROGRAM_FILES%\uusee\def\UUDEF_Banner_5.html
%TEMP%\UUTV_Stop.html
%PROGRAM_FILES%\uusee\def\UUDEF_Banner_8.html
%TEMP%\UUTV_DL.html
%PROGRAM_FILES%\uusee\def\UUDEF_Banner_8.gif
%TEMP%\234890.1245.xml
%TEMP%\234921.287.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\UUTV_VOD_HOT.zip[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\exit1[1].xml
%TEMP%\exitad.xml
%PROGRAM_FILES%\uusee\def\UULOG.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\UULOG_NEW[1].dat
%TEMP%\264968.4129
%CommonProgramFiles%\uusee\flvad.xml
%TEMP%\280843.7307
%TEMP%\301000.2549
%CommonProgramFiles%\uusee\flvad.xml.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getUserHabit[1].action
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\flvad[1].xml
%TEMP%\252390.1245
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uuseepop_yy[1].xml
%TEMP%\247265.7977
%TEMP%\246343.4671
%TEMP%\UUTV_STAT_VOD.xml.zip
%TEMP%\uuseepop_yy.xml
%TEMP%\257484.387
%TEMP%\260656.1631
<SYSTEM32>\d3d9caps.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\qipao[1].xml
%TEMP%\qipao.xml
%PROGRAM_FILES%\uusee\def\UUDEF_Banner_0.html
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Play_5.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Setting_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Play_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Media_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Play_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Setting_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Side_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Side_5.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Side_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Setting_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Side_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Info.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Main_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Control_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Control_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Control_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Main_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Media_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Media_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Media_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Main_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Main_5.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Tip.bmp
%TEMP%\UUTV_2008.zip.html.down
%PROGRAM_FILES%\Mozilla Firefox\plugins\npuuseep.dll
%TEMP%\nsr2.tmp\ZipDLL.dll
%TEMP%\nsr2.tmp\inetc.dll
%TEMP%\videocodec_2012.zip
%TEMP%\nsr2.tmp\Math.dll
%PROGRAM_FILES%\uusee\def\UUDEF_Banner_20.html
%PROGRAM_FILES%\uusee\def\UUDEF_Banner_0.jpg
%PROGRAM_FILES%\uusee\def\UUDEF_Banner_20.gif
%WINDIR%\struct~.ini
%TEMP%\UUDEF_Error.html
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Toolbar_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Web.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Toolbar_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Toolbar_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Wnd_Toolbar_2.bmp
%ALLUSERSPROFILE%\Start Menu\Programs\UUSee НшВзµзКУ\Жф¶ЇUUSee НшВзµзКУ.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UUSee НшВзµзКУ\Р¶ФШUUSee НшВзµзКУ.lnk
%ALLUSERSPROFILE%\Desktop\UUSee НшВзµзКУ.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UUSee НшВзµзКУ\·ГОКUUSee НшХѕ.lnk
%PROGRAM_FILES%\uusee\UUSee.url
%ALLUSERSPROFILE%\Start Menu\Programs\UUSee НшВзµзКУ\УЖКУУОП·ЦРРД.lnk
%CommonProgramFiles%\uusee\review\skin_volume.gif
%CommonProgramFiles%\uusee\review\skin_volumebar.gif
%CommonProgramFiles%\uusee\review\skin_stop.gif
%CommonProgramFiles%\uusee\review\skin_qnext.gif
%CommonProgramFiles%\uusee\review\skin_share.gif
%CommonProgramFiles%\uusee\review\skin_volumebarbg.gif
%TEMP%\xinhezuo-uusee-1.exe
%ALLUSERSPROFILE%\Start Menu\Programs\百度地址栏\卸载百度地址栏.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\xinhezuo-uusee-1[1].exe
%CommonProgramFiles%\uusee\review\skin_volumebarbg2.gif
%CommonProgramFiles%\uusee\uninst.exe
%CommonProgramFiles%\uusee\review\skin1_bufferbar.gif
%CommonProgramFiles%\uusee\review\skin1_bufferbg0.gif
%CommonProgramFiles%\uusee\review\local.htm
%CommonProgramFiles%\uusee\review\Thumbs.db
%CommonProgramFiles%\uusee\review\bf_bg.gif
%CommonProgramFiles%\uusee\review\skin1_bufferbg1.gif
%CommonProgramFiles%\uusee\review\skin_play.gif
%CommonProgramFiles%\uusee\review\skin_qback.gif
%CommonProgramFiles%\uusee\review\skin_pause.gif
%CommonProgramFiles%\uusee\review\skin_fullscreen.gif
%CommonProgramFiles%\uusee\review\skin_mute.gif
%CommonProgramFiles%\uusee\LocalInfo.ini
%PROGRAM_FILES%\uusee\skins\UUPlayer\ChatRoom_button_Res_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\ChatRoom_button_Res_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\ChatRoom_button_Res_1.bmp
%PROGRAM_FILES%\uusee\uninstuusee.exe
%PROGRAM_FILES%\uusee\skins\UUPlayer\About.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_FullScreen_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_Recording_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_Recording_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_Recording_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_FullScreen_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_FullScreen_3.bmp
%PROGRAM_FILES%\uusee\uusee.ico
%PROGRAM_FILES%\uusee\UUPlayer.dll
%PROGRAM_FILES%\uusee\g.uusee.com.ico
%CommonProgramFiles%\uusee\UUPlayer_2010_path.ini
%PROGRAM_FILES%\uusee\ugege.ico
%PROGRAM_FILES%\uusee\UUSeePlayer.exe
%PROGRAM_FILES%\uusee\geturltoplay.htm
%PROGRAM_FILES%\uusee\geturltodown.htm
%PROGRAM_FILES%\uusee\uusee.swf
%PROGRAM_FILES%\uusee\UUPlayer_2010_update.ini
%PROGRAM_FILES%\uusee\UUPlayer_2010_update_360.ini
%CommonProgramFiles%\uusee\UUUpgrade.ini
%TEMP%\GoogleToolbarInstaller2.log
%CommonProgramFiles%\uusee\UFDeMux.ax
%TEMP%\nsp4.tmp
%CommonProgramFiles%\uusee\kumidesktop.ico
%CommonProgramFiles%\uusee\mp4demux.ax
%CommonProgramFiles%\uusee\UFSource.ax
%CommonProgramFiles%\uusee\check_cmd.exe
%CommonProgramFiles%\uusee\UUPlayer.exe
%PROGRAM_FILES%\Baidu\AddressBar\AddressBar_Tmp\AddressBar.dll
%CommonProgramFiles%\uusee\rmsp011.ax
%CommonProgramFiles%\uusee\UUPlayer.ocx
%TEMP%\nsr2.tmp\FindProcDLL.dll
%TEMP%\upercent.gif
%TEMP%\nsr2.tmp\System.dll
%TEMP%\UUSEE_niuniu_Setup_152.exe
%TEMP%\nsr2.tmp\AnimGif.dll
%TEMP%\UUSeeDownLoad.exe
%CommonProgramFiles%\uusee\UUWebPlayer.ocx
%TEMP%\GoogleToolbarInstaller_download_signed.exe
<SYSTEM32>\nsis_loader.dll
%TEMP%\Baidu-ASBar.exe
%CommonProgramFiles%\uusee\download.dll
%CommonProgramFiles%\uusee\UUUpgrade.dll
%CommonProgramFiles%\uusee\recommend.dll
%CommonProgramFiles%\uusee\UUUpgrade.ocx
%CommonProgramFiles%\uusee\out_mmshttp.dll
%CommonProgramFiles%\uusee\UUUpgrade.exe
%CommonProgramFiles%\uusee\seeplayer.ocx
%CommonProgramFiles%\uusee\npuuseep.dll
%CommonProgramFiles%\uusee\MediaCenter.ini
%ALLUSERSPROFILE%\Start Menu\Programs\百度地址栏\百度地址栏官网.url
%CommonProgramFiles%\uusee\trafficlight.dll
%CommonProgramFiles%\uusee\UUSeeMediaCenter.exe
%CommonProgramFiles%\uusee\EnetDepNee.dll
%PROGRAM_FILES%\Baidu\AddressBar\AddressBar.dll
%CommonProgramFiles%\uusee\EnetDep.dll
%CommonProgramFiles%\uusee\videoAccDll.dll
%CommonProgramFiles%\uusee\ENet.dll
%CommonProgramFiles%\uusee\Microsoft.VC90.CRT.manifest
%CommonProgramFiles%\uusee\in_net.dll
%PROGRAM_FILES%\Baidu\AddressBar\ASBarBroker.exe
%CommonProgramFiles%\uusee\CoCode.dll
%CommonProgramFiles%\uusee\msvcp90.dll
%CommonProgramFiles%\uusee\msvcr90.dll
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_ScrollBarThumb_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_ScrollBarThumb_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_ScrollBarThumb_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_Header_Spliter.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_ScrollBarThumb_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_ScrollBar_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_StatusErr.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_StatusExist.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_ScrollBar_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_ScrollBar_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_ScrollBar_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_HScrollBar_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_HScrollBar_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_HScrollBarThumb_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_HScrollBarThumb_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_HScrollBarThumb_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_HScrollBar_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_Header_N.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_Header_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_Header_H.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_HScrollBar_S.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_Header_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_StatusFin.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_Block_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_Block_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_BM_7.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_BM_5.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_BM_6.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_Block_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_1_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_1_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Setting_Group_1_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_Block_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Resource.h
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_StatusStop.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_StatusWait.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_StatusPlay.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_StatusNotFound.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_StatusPause.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Play_Window_Rec_icon.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_BM_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_BM_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_BM_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_BM_0.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Progressbar_BM_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\List_HScrollBarThumb_D.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_ComboBox_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_ComboBox_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_ComboBox_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_CheckBox_C4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_ComboBox_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_Edit_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_PushButton_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_PushButton_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_PushButton_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_Edit_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_PushButton_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_pause_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_CheckBox_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_pause_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_pause_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Control_Button_pause_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_CheckBox_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_CheckBox_C2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_CheckBox_C3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_CheckBox_C1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_CheckBox_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_CheckBox_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_RadioButton_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Icon_Question.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Icon_Stop.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Icon_Information.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Dlg_Frame_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Error.jpg
%PROGRAM_FILES%\uusee\skins\UUPlayer\ListHeader_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\ListHeader_ArrowU.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\ListHeader_SP.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\ListHeader_ArrowD.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\ListHeader_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\ListHeader_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_RadioButton_C1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_RadioButton_C2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_RadioButton_4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_RadioButton_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_RadioButton_3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_RadioButton_C3.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Dlg_Frame_1.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Dlg_Frame_2.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Dlg_Detect.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Ctrl_RadioButton_C4.bmp
%PROGRAM_FILES%\uusee\skins\UUPlayer\Dlg_Back.bmp

Deletes the following files:

%TEMP%\246343.4671
%TEMP%\247265.7977
%TEMP%\242140.571
%TEMP%\240546.1689
%TEMP%\241812.6075
%TEMP%\252390.1245
%TEMP%\280843.7307
%TEMP%\301000.2549
%TEMP%\264968.4129
%TEMP%\257484.387
%TEMP%\260656.1631
%TEMP%\237046.7282
%TEMP%\nsr2.tmp\AnimGif.dll
%TEMP%\nsr2.tmp\FindProcDLL.dll
%TEMP%\upercent.gif
%TEMP%\~DF2740.tmp
<SYSTEM32>\nsis_loader.dll
%TEMP%\nsr2.tmp\inetc.dll
%TEMP%\234890.1245.xml
%TEMP%\234921.287.xml
%TEMP%\nsr2.tmp\ZipDLL.dll
%TEMP%\nsr2.tmp\Math.dll
%TEMP%\nsr2.tmp\System.dll

Network activity:

Connects to:

'pl.##see.com':80
'up####.uusee.com':80
'hk####nt.uusee.com':80
'uu###.uusee.com':80
'localhost':1057
'uh##.uusee.com':80
'sa#.#usee.com':80
'sa.##see.com':80
'wp#d':80
'localhost':1040
'localhost':1036
'do##.yunduan.cn':80
'pl####.uusee.com':80
'localhost':1045
'74.##5.232.51':80
'do####ad.uusee.com':80

TCP:

HTTP GET requests:

sa#.#usee.com/pop/uuseepop_yy.xml
sa.##see.com/2009/qp/ini/qipao.xml
pl.##see.com/UUTV_VOD_HOT.zip.html
up####.uusee.com/mini3/uusee_client_update/uuplayer/UUPlayer_2010_update_360.ini
sa.##see.com/2010/exit/exit1.xml
sa.##see.com/2010/flv/flvad.xml
uh##.uusee.com/uhms/getUserHabit.action?ma##############
sa.##see.com/uulog/2009/UULOG_NEW.dat
pl.##see.com/UUTV_LIVE_HOT.zip.html
74.##5.232.51/toolbar/components/Toolbar.6.5.manifest.xml.lz?zx######
do####ad.uusee.com/soft/videocodec_2012.zip
do##.yunduan.cn/yddown/xinhezuo-uusee-1.exe
wp#d/wpad.dat
hk####nt.uusee.com/right_2010.html
uu###.uusee.com/uudef/eng_uusee_2010.zip.html
pl####.uusee.com/pl2010/ROOT.zip.html
hk####nt.uusee.com/float_2010.html

UDP:

DNS ASK pl.##see.com
DNS ASK up####.uusee.com
DNS ASK uu###.uusee.com
DNS ASK www.uu##e.com
DNS ASK uh##.uusee.com
DNS ASK po##.uusee.com
DNS ASK sa#.#usee.com
DNS ASK sa.##see.com
DNS ASK lo####ver.uusee.com
DNS ASK pl####.uusee.com
DNS ASK dl.##ogle.com
DNS ASK do####ad.uusee.com
DNS ASK wp#d
DNS ASK hk####nt.uusee.com
DNS ASK do##.yunduan.cn
DNS ASK lo#.#usee.com
'22#.0.0.88':8000
'11#.#38.87.236':8000
'22#.#2.88.181':8000
'21#.#53.56.90':8000
'po##.uusee.com':8000
'61.##6.17.228':8000
'22#.#38.29.122':8000
'21#.#37.232.84':9800
'lo#.#usee.com':9900
'lo####ver.uusee.com':9900
'lo#.#usee.com':10160
'lo####ver.uusee.com':10160
'lo#.#usee.com':10110
'lo####ver.uusee.com':10110
'lo#.#usee.com':9800
'lo####ver.uusee.com':9800

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MPWClass' WindowName: ''
ClassName: 'MsnMsgrUIManager' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'UIWND' WindowName: 'UUSee????2010'
ClassName: '' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial