Search

name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.) It creates the following folders: %User Profile%\CryptnetUrlCache\MetaData %User Profile%\Microsoft

PE_SALITY.BA-O

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center AntiVirusDisableNotify = 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center AntiVirusOverride = 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center

PE_SALITY.BU-O

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center AntiVirusDisableNotify = 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center AntiVirusOverride = 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center

BKDR_FYNLOS.WIU

%User Profile%\10.0\Forms %User Profile%\10.0\Collab %User Profile%\10.0\Security %User Profile%\Security\CRLCache %User Profile%\CryptnetUrlCache\MetaData %User Profile%\Microsoft\CryptnetUrlCache %User

TROJ_DROPPR.JS

\10.0\Collab %User Profile%\10.0\Security %User Profile%\Security\CRLCache %User Profile%\CryptnetUrlCache\MetaData %User Profile%\Microsoft\CryptnetUrlCache %User Profile%\CryptnetUrlCache\Content %User

TSPY_GOLROTED.AUSQ

%User Profile%\Microsoft\CryptnetUrlCache %User Profile%\CryptnetUrlCache\Content %User Profile%\10.0\Forms %User Profile%\10.0\Collab %User Profile%\10.0\Security %User Profile%\Security\CRLCache

TSPY_GOLROTED.AUSSJL

%User Profile%\Microsoft\CryptnetUrlCache %User Profile%\CryptnetUrlCache\Content %User Profile%\10.0\Forms %User Profile%\10.0\Collab %User Profile%\10.0\Security %User Profile%\Security\CRLCache

TROJ_BANLOAD.ICV

Other System Modifications This Trojan adds the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center\Svc HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ Microsoft\Windows Defender

TROJ_UPATRE.UI

Profile%\CryptnetUrlCache\MetaData %User Profile%\Microsoft\CryptnetUrlCache %User Profile%\CryptnetUrlCache\Content %User Profile%\10.0\Forms %User Profile%\10.0\Collab %User Profile%\10.0\Security %User

TSPY_BUZUS.BCCN

), Windows Server 2008, and Windows Server 2012.) It creates the following folders: %User Profile%\10.0\Forms %User Profile%\10.0\Collab %User Profile%\10.0\Security %User Profile%\Security\CRLCache

TROJ_UPATRE.YYSIY