Search
Keyword: microsoft internet explorer
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Microsoft\Dr Watson (Note:
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 1CWS0413 = "%User Profile%\Application Data\1CWS0413.exe " HKEY_CURRENT_USER\Software\Microsoft\ Windows
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run iexplower = "%System%\ctfmom32.exe" Other System Modifications This Trojan adds the following registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run DisplaySwitch = "%User Profile%\Templates\syssecurity.exe" Other System Modifications This Trojan adds the following registry keys: HKEY_LOCAL_MACHINE
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Client Server Runtime Process = "%Application Data%\csrss.exe" HKEY_CURRENT_USER
system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run update = "%System%\update.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run SkypeMobile = "%System%
\WinShell\WinSeven.exe %System Root%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\taskhost.exe (Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run java32run = "%System%\svchost1.exe" Other System Modifications This Trojan adds the following registry
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 1CWS12D108 = "regsvr32 /s %User Profile%\Application Data\1CWS12D108.jpg " HKEY_CURRENT_USER\Software
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 1CWS02N12 = "regsvr32 /s %User Profile%\Application Data\1CWS02N12.jpg " HKEY_CURRENT_USER\Software
system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run ieupdate = "%System%\ieexplorer32.exe" Other System Modifications This Trojan adds the following registry entries:
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\2CBE016A-8F28-4E0C-83A6-6079161294D7 StubPath = "%System Root%\Setup\CacheMgr.exe -ax" Other System
entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe" HKEY_LOCAL_MACHINE\SOFTWARE
Installation This backdoor drops the following copies of itself into the affected system: %Application Data%\Microsoft\Windows\Themes\nvidia.exe (Note: %Application Data% is the Application Data folder, where it
1567 Autostart Technique This spyware adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Microsoft\Dr Watson (Note:
{user name} on Windows Vista and 7.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft