Search

and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).) Other System Modifications

folders: %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft (Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.) Dropping Routine

Vista and 7.) Other System Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ Multimedia\DrawDib It adds the following registry entries: HKEY_CURRENT_USER

{user name} on Windows Vista and 7.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft

its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Windows Update Installer = "%User Profile%\WindowsUpdate\Updater.exe" HKEY_LOCAL_MACHINE

its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Windows Update Installer = "%User Profile%\WindowsUpdate\Updater.exe" HKEY_LOCAL_MACHINE

its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Windows Update Installer = "%User Profile%\WindowsUpdate\Updater.exe" HKEY_LOCAL_MACHINE

\Local\Temp on Windows Vista and 7.) Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft

Data%\Microsoft\Diagnosis\ADBS.DAT Heur.BZC.PZQ.Boxter.826.8F15D11C (Bitdefender) Downloaded from the Internet, Dropped by other malware

http://download.microsoft.com/download/3/5/9/35980F81-60F4-4DE3-88FC-8F962B97253B/NDP461-KB3102438-Web.exe Other Details This Ransomware connects to the following URL(s) to check for an Internet connection: http://go.microsoft.com/ It does the following: This malware is a ZIP file containing the

system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {FF66B1D3-574A-3E6F-92A4-1968F02402A6} = %Application Data%\{random1}\{random}.exe Information Theft This spyware attempts

routine: explorer.exe Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup

HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Run {random numbers} = "%All Users Profile%\{random}.exe" (For Windows Vista and higher versions) HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows

\System32 on Windows XP and Server 2003.) Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft

\System32 on Windows XP and Server 2003.) Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft

System Modifications This spyware adds the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-AE2121BHJLK} It adds

%Application Data%\Microsoft\svcrshost.exe (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:

execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run smartlink = "%Program Files%\smartlink\smartlinke.exe" Other System Modifications This Trojan deletes the

\System32 on Windows XP and Server 2003.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft

file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Microsoft\Dr Watson (Note: