Troj/Dloader-UQ is a Trojan for the Windows platform.
Troj/Dloader-UQ includes functionality to access the internet and communicate
with a remote server via HTTP.
When first run Troj/Dloader-UQ copies itself to:
<Windows<\osrss.exe
<System<\coniem.exe
The following registry entry is created to run osrss.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfnom.exe
<Windows<\OSRSS.exe
The following registry entry is set or modified, so that coniem.exe is run when
files with extensions of TXT are opened/launched:
HKCR\txtfile\shell\open\command
(default)
<System<\CONIEM.exe "%1"
Troj/Dloader-UQ changes the Start Page for Microsoft Internet Explorer by
setting the registry entry:
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
The following registry entries are set:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableTaskMgr
1
HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
HomePage
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden
SHOWALL
CheckedValue
0