Search

\Microsoft\ Windows\CurrentVersion\RunOnce {Random Hash} = "%User Temp%\{Random Number}.exe" Other System Modifications This spyware adds the following registry entries as part of its installation routine:

\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.) It adds the following processes: svchost.exe

\Internet Explorer\DECRYPT_INSTRUCTIONS.html %User Profile%\Internet Explorer\DECRYPT_INSTRUCTIONS.txt %Application Data%\Microsoft\Windows Media\9.0\DECRYPT_INSTRUCTIONS.html %Application Data%\Microsoft

\Programs\Accessories\Command Prompt.lnk %Start Menu%\Programs\Windows Media Player.lnk %Start Menu%\Programs\Accessories\Notepad.lnk %Start Menu%\Programs\Accessories\Program Compatibility Wizard.lnk %Start

different for 2011. This attack recently gained media attention and was dubbed as the “Night Dragon” attack. How does this threat arrive on users' systems? This threat involved targeted attacks against

%/WINDOWS/Intelx386/Download Accelerator Plus (DAP) (full version with serial).exe %System Root%/WINDOWS/Intelx386/RealOne Player (Full version).exe %System Root%/WINDOWS/Intelx386/BsPlayer v3.exe %System Root

the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.) It injects threads into

Media\9.0\DECRYPT_INSTRUCTIONS.html %Application Data%\Microsoft\Windows Media\9.0\DECRYPT_INSTRUCTIONS.txt %User Profile%\Templates\DECRYPT_INSTRUCTIONS.html %User Profile%\Templates

\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe %System%\svchost.exe -k NetworkService "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" (Note: %User Temp% is the current user's Temp folder, which is

{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A} FLast = "%Application Data%\Microsoft\Media Player\CurrentDatabase_59R.wmdb" HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A} FNum = "1f" HKEY_LOCAL_MACHINE

NetworkService "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" (Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System Root% is the

sites and compromised websites. What makes these new variants notable? The February variants of VAWTRAK are notable due to their abuse of macros and Windows PowerShell , as well as their capacity to steal

{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A} FNum = "27" HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A} FLast = "%Application Data%\Microsoft\Media Player\CurrentDatabase_59R.wmdb" HKEY_LOCAL_MACHINE

Root%\Documents and Settings\Wilbert %User Profile%\Application Data\Macromedia %User Profile%\Macromedia\Flash Player %User Profile%\Flash Player\macromedia.com %User Profile%\macromedia.com\support

\amd64_microsoft-windows-rasbase-raspppoe_31bf3856ad364e35_6.1.7600.16385_none_b22875c7b448dfbb %Windows%\inf\SMSvcHost 4.0.0.0\0011 %Windows%\winsxs\x86_microsoft-windows-i..onal-codepage-20838_31bf3856ad364e35_6.1.7600.16385_none_5277936547471708 %Program Files%\Windows Sidebar\Gadgets

\Programs\Windows Custodian Utility.lnk %User Profile%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sol %Windows%\system32\d3d9caps.dat It terminates the

Menu/Programs/Accessories/Entertainment/desktop.ini %System Root%/Documents and Settings/Default User/Start Menu/Programs/Accessories/Entertainment/Windows Media Player.lnk %System Root%/Documents and Settings/Default User/Start

WinFTP WiseFTP It attempts to steal stored email credentials from the following: IncrediMail MS Outlook Poco Systems Pocomail RIT The Bat! RimArts Internet Mail Thunderbird Windows Live Mail Windows Mail

\v4.0.30319\mscorsvw.exe %System%\sppsvc.exe "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe" %System%\svchost.exe -k netsvcs (Note: %User Temp% is the current user's Temp folder, which is

and executes them: %User Temp%\tmp{random number and/or letter}.exe - deleted afterwards %Application Data%\Microsoft\Windows\IEUpdate\{random name}.exe (Note: %User Temp% is the user's temporary