Symptoms

Removal instructions:

Analyzed By

Technical Description:

- the trojan is a DLL which is dropped and loaded by another malware;
- its only action is to download a trojan to %temp%\QQ_Update.cab which is heuristically detected by BitDefender as BehavesLike:Win32.ExplorerHijack;
- after executing the new trojan it moves itself to %temp%\qqsXXXX.tmp\qqsXXXX.tmp and schedules to be deleted at next reboot (XXXX represents a string of at least 1 and maximum 4 hex digits);
- although it seems as a simple trojan, it is very dangerous because the downloaded trojan also downloads over 40 other malware.