This virus is most in the form of a dynamic library, dynamic library leads to a function, this function is called after the virus will modify the system registry to have the following entries:
1
HKEY_CURRENT_USER\Software\Microsoft\internet eXPlorer
searchurl : http://qwertysearch123.biz/?id=1017
2
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
start page : http://qwertysearch123.biz/?id=1017
3
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
search page : http://qwertysearch123.biz/?id=1017
4 HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
search bar : http://qwertysearch123.biz/?id=1017
5 HKEY_USERS\.Default\Software\Microsoft\internet explorer
searchurl : http://qwertysearch123.biz/?id=1017
6 HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Main
start page : http://qwertysearch123.biz/?id=1017
7
HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Main
search page : http://qwertysearch123.biz/?id=1017
8
HKEY_USERS\.Default\Software\Microsoft Internet Explorer\Main
search bar : http://qwertysearch123.biz/?id=1017
9
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Currentversion\Run
Desktop : rundll32.exe C:\Windows\SYSTEM\avpcc.dll,Restore ControlPanel
10
HKEY_LOCAL_MACHINE\System
\CurrentControlSet\Control\SessionManager Known16DLLs\avpcc.dll
"vpcc.dll"
Copyright © 2026 eLLeNow.com All Rights Reserved.