Be careful with "U 3 3.c n" in QQ information (propagation: QQ podcast variant XK/Trojan. qqmsg. boker. XK)

EndurerOriginal

1Version

Qq of Some netizens will automatically send the following information:

 

Hello (xxxxxxx), I have not accessed the Internet these two days. Today, an online friend sent me a QQ video. When I saw the QQ nickname of the person, it was also called XXXXXXXX ), not you, right? Is the performance too explicit? Hope it's not you. You 'd better check it out! Enter the following URL in the browser to download (remove spaces) U 3 3.c n

After opening U 3 3.c N, the file will be downloaded. Qqshow.exe.

 

Qqshow.exe is compiled by Microsoft Visual Studio/vb98 (80,384 bytes) and shelled by nspack (20,403 bytes ).

After running qqshow.exe, it will write data in % WINDIR %/System

 

 

Cyuhrqzhn.exe
N0Tepad. EXE (Note: The Second file name is a number 0 rather than an English letter)

 

 

.

Kaspersky reports:Trojan-Clicker.Win32.VB.nx(Http://www.viruslist.com/en/viruses/encyclopedia? Virusid= 125048)
Rising Report: QQ podcast variant XK (Trojan. qqmsg. boker. XK) (The rising virus database does not have any information about this trojan, but the daily computer virus and Trojan broadcast released on April 9, June 30 gave a warning)