ADW_HIDEBAID

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This adware deletes the following files:

• %Start Menu%\Programs\???PPS??.lnk
• %Desktop%\???PPS ??.lnk
• %Desktop%\$????-????$.qmgc
• %Desktop%\????.lnk
• %Desktop%\????????.lnk
• %Desktop%\9158????.lnk
• %Desktop%\9158¶àÈËÊÓƵ.lnk
• %Desktop%\2345?????.lnk
• %Desktop%\?????.lnk
• %Desktop%\QQ???.lnk
• %Desktop%\ôÜʶÎ×Ó.lnk
• %Desktop%\ÐãÐãÖ±²¥ÊÒ.lnk
• %Desktop%\??.lnk
• %Desktop%\My Box.lnk
• %Desktop%\??????.lnk
• %Desktop%\????-????.lnk
• %Desktop%\$????$.xlkkvd
• %User Startup%\???PPS??.lnk
• %Start Menu%\???PPS??.lnk
• %Start Menu%\?????.lnk
• %Start Menu%\2345?????.lnk
• %Start Menu%\????.lnk
• %Start Menu%\?????????? .lnk
• %User Profile%\Quick Launch\???PPS??.lnk
• %User Profile%\Quick Launch\9158????.lnk
• %User Profile%\Quick Launch\????.lnk
• %User Profile%\Quick Launch\9158¶àÈËÊÓƵ.lnk
• %User Profile%\StartMenu\???PPS??.lnk
• %User Profile%\TaskBar\???PPS??.lnk
• %User Profile%\TaskBar\?????.lnk
• %User Profile%\StartMenu\????.lnk
• %User Profile%\StartMenu\?????????? .lnk
• %User Profile%\StartMenu\??????.lnk
• %User Profile%\StartMenu\????-????.lnk
• %User Profile%\StartMenu\2345?????.lnk
• %User Profile%\StartMenu\QQ???.lnk
• %User Profile%\TaskBar\??????.lnk
• %User Profile%\TaskBar\2345?????.lnk
• %User Profile%\TaskBar\9158????.lnk
• %User Profile%\TaskBar\9158¶àÈËÊÓƵ.lnk
• %User Profile%\TaskBar\????.lnk

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It deletes the following folders:

• %Start Menu%\Programs\???
• %Start Menu%\Programs\????
• %Start Menu%\Programs\??????
• %Start Menu%\Programs\Rising Antivirus
• %Start Menu%\Programs\?????
• %Start Menu%\Programs\2345????
• %Start Menu%\Programs\????\????
• %Start Menu%\Programs\????\????-????
• %Start Menu%\Programs\ħÊÖÆ´Òô
• %Start Menu%\Programs\ôÜʶÎ×Ó
• %Start Menu%\Programs\????\QQ???
• %Start Menu%\Programs\9158????
• %Start Menu%\Programs\PPT????
• %Start Menu%\Programs\??
• %Start Menu%\Programs\My Box
• %Start Menu%\Programs\9158¶àÈËÊÓƵ

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It deletes the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B5C48CDD-6C11-453D-91B4-59CFCE233D27}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
ħÊÖÆ´ÒôÊäÈë·¨

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
PPTAssist

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
bfAppEngine

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
LiveRoom

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
????

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
????-????

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
??????????

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
QQBrowser

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
2345chrome

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
2345Explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
BaiduPinyin

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
9158????

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
9158¶àÈËÊÓƵ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
QQPCMgr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
RSD

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
RZC

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
RAV

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
??????

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{96F04C1B-E352-4A90-BED4-11A0FA968BC1}_is1

HKEY_CLASSES_ROOT\CLSID\{33A895C1-4269-466F-9B01-0C8AEFB64AC3}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
MyComputer\NameSpace\{33A895C1-4269-466F-9B01-0C8AEFB64AC3}

HKEY_CLASSES_ROOT\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
MyComputer\NameSpace\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}

HKEY_CLASSES_ROOT\CLSID\{1A3BD145-3384-4F81-9F6C-10F045887FD3}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
MyComputer\NameSpace\{1A3BD145-3384-4F81-9F6C-10F045887FD3}

This report is generated via an automated analysis system.