Search
Keyword: URL
following fake alerts: When users agree to buy the software, it connects to the following URL to continue the purchase: http://{BLOCKED}rtal360.com/404.php?id=105 http://{BLOCKED
information: List of strings it will monitor usually related to banking URL to send stolen information Stolen Information This spyware sends the gathered information via HTTP POST to the following URL: http:
Firefox)/Chrome Service Pack (for Google Chrome) to certain web browsers: .crx (for Google Chrome) .xpi (for Mozilla Firefox) It connects to the following URL to update its stat counter: http://whos.
and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.) NOTES: It only connects to the following URL every Tuesday between 8:00 AM and 6:59 PM: http://{BLOCKED}s.{BLOCKED
following fake alerts: When users agree to buy the software, it connects to the following URL to continue the purchase: http://{BLOCKED}rtal360.com/404.php?id=105 http://{BLOCKED
C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.) It downloads a possibly malicious file from a certain URL. The URL where this malware downloads the said file depends on the following
[OpenURL] - Opens a URL using a hidden browser [SYN] - Sends a SYN Flood [Stop] - Stops a spcific command [Get] - Sends GET floods [Post] Sends POST floods [Speedtest] - check connection speed
\ Services\Windows Adobe Flash Game 3.6 Enum = Backdoor Routine This backdoor opens the following ports: TCP 777 It executes the following commands from a remote malicious user: Open a specific URL with
Files\System\ado\adoc.exe"" (Note: The default value data of the said registry entry is "Explorer.exe" .) Download Routine This Trojan downloads the file from the following URL and renames the file when
command execXbox - visit a URL This malware automatically adds the following URLs to the phone's bookmarks. More URLs can be received and added by the malware when commanded. http://{BLOCKED}d.paojiao.cn
" HKEY_CURRENT_USER\Software\Microsoft\ Internet Explorer\SearchScopes\{853FB6B1-8FFF-448D-83A4-516B8E59BF25} URL = "http://universo.{BLOCKED}x.com/campos?campo={searchTerms}" HKEY_CURRENT_USER\Software\Microsoft
TabProcGrowth = "0" HKEY_LOCAL_MACHINE\ SOFTWARE\ MICROSOFT\ Windows\ CURRENTVERSION\ URL SystemMgr = "Del" HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\ protected\AVP7\profiles\ Updater enabled = "0" Other Details
TabProcGrowth = "0" HKEY_LOCAL_MACHINE\ SOFTWARE\ MICROSOFT\ Windows\ CURRENTVERSION\ URL SystemMgr = "Del" HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\ protected\AVP7\profiles\ Updater enabled = "0" Other Details
following URL to continue the purchase: http://{BLOCKED}tion-privacy.com/buynow.php NOTES: It displays the following fake scanning window and bogus alerts on the affected system: It terminates all running
TabProcGrowth = "0" HKEY_LOCAL_MACHINE\ SOFTWARE\ MICROSOFT\ Windows\ CURRENTVERSION\ URL SystemMgr = "Del" HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\ protected\AVP7\profiles\ Updater enabled = "0" Other Details
thread performing its malicious routines. It also executes the legitimate file %System%\wdmaud.drv . This Trojan may connect to the URL liyanyanzy.{BLOCKED}2.org This Trojan does not have rootkit
TabProcGrowth = "0" HKEY_LOCAL_MACHINE\ SOFTWARE\ MICROSOFT\ Windows\ CURRENTVERSION\ URL SystemMgr = "Del" HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\ protected\AVP7\profiles\ Updater enabled = "0" Other Details
Extension} = %Application Data%\{Random File Name}.exe {Random Numbers} Other Details This Trojan displays the following message boxes: Security Tool Installed. It does the following: It connects to this URL
Manipulate system sound volume Open Web pages Read/Write/Delete registry values Record sounds using microphone Remove itself Send emails Start/Stop services Update itself It connects to the following URL to
voir absolument. Once an unsuspecting user clicks on the said video, it plays a YouTube video. It then triggers an automatic Like on Facebook for a malicious URL and displays the link on the wall of the