Troj/QQPass-N is a password stealing Trojan for the Windows platform.
When first run Troj/QQPass-N copies itself to:
<Temp>\temp~2
<System>\Updadv.exe
and creates the following files:
<System>\Updadv.dll
<System>\temp1.jpg
Updadv.dll and temp1.jpg are innocuous files and may be simply deleted.
The following registry entries are created to run Updadv.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
winhelp
Updadv.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
expler
Updadv.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce
Rundil32
Updadv.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
Regexit
Updadv.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
sdsr
Updadv.exe
Troj/QQPass-N may try to terminate security-related processes.