- the trojan is a DLL which is dropped and loaded by another malware;
- its only action is to download a trojan to %temp%\QQ_Update.cab which is heuristically detected by BitDefender as BehavesLike:Win32.ExplorerHijack;
- after executing the new trojan it moves itself to %temp%\qqsXXXX.tmp\qqsXXXX.tmp and schedules to be deleted at next reboot (XXXX represents a string of at least 1 and maximum 4 hex digits);
- although it seems as a simple trojan, it is very dangerous because the downloaded trojan also downloads over 40 other malware.
Please let BitDefender delete your malware files.
- presence of the following files:
%windir%\Temp\wmsetup.dll
%temp%\wmsetup.dll
%temp%\QQ_Update.cab

Subscribe
Hot Articles