Troj/QQPass-U is a password stealing Trojan for the Windows platform.
When first run Troj/QQPass-U copies itself to:
<Temp>\temp~2
<System>\runlli32.exe
and creates the following files:
<System>\temp1.jpg
<System>\winnnn.dll
The files temp1.jpg and winnnn.dll are not malicious and can simply be deleted.
Troj/QQPass-U may try to terminate security related processes.
The following registry entries are created to run runlli32.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Rnudll32
runlli32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
sdsr
runlli32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Rundli32
runlli32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEYok
runlli32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce
Rundil32
runlli32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
chope
runlli32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
Regexit
runlli32.exe