Behavior Details

1. Files Added/Modified:
Folder: C:\ProgramData\Google\Chrome\zqm434y66t\
• google.dll
• googleanc.dll

2. Registry Keys Added/Modified:
Under Key:
HKEY_USERS\.DEFAULT\Software\Google\Chrome\zqm434y66t
• TRYED = 1
• LDR = [Binary Data (334 bytes)]
• UDIR = C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\zqm434y66t
• ISZ = 7395840
• WRP = [Binary Data (335 bytes)]
• SETUP = 1
• EPOCH = 1
• LSZ = 542627
• IMG = [Binary Data (309 bytes)]
• INST = 1988984
• TRYED = 0
• LASTRUN = 1988984
Under Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\zqm434y66t
• ISZ = 7395840
• LDR = [Binary Data (334 bytes)]
• ANCOR = [Binary PE Payload (417 bytes)]
• IMG = [Binary Data (309 bytes)]
• LSZ = 542627

3. Services & Scheduled Tasks Created:
Service: GoogleUpdateTaskzqm434y66t
Service: WSearch

Removal Instructions

1. Update K7 security to the latest version.
2. Open Windows registry editor and delete the following keys:
HKEY_USERS\.DEFAULT\Software\Google\Chrome\zqm434y66t
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\zqm434y66t
3. Restart the machine.