Search
Keyword: microsoft internet explorer
).) Other System Modifications This Potentially Unwanted Application adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ RestartManager\Session0000 Owner = "\xcc\x0b\x00\x00
http://{BLOCKED}gidare.com/f64bj/jtrhs.php?l=ghs1.cab %Windows%\temp\12345.dll Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note:
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
path and file name} Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
path and file name}.000Z Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
system: %Application Data%\Microsoft\Chkwtxml\apiMFWGP.exe (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on
* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services - Client 1004293* - Identified Microsoft Windows Shortcut File Over Network Share DHCP Failover Protocol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft Tracing = enigma_RASMANCS HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft Tracing = enigma_RASAPI32 Download Routine This Trojan Spy connects to the following URL(s) to download its
HKEY_CLASSES_ROOT\magnet HKEY_CLASSES_ROOT\magnet\DefaultIcon HKEY_CLASSES_ROOT\magnet\shell HKEY_CLASSES_ROOT\magnet\shell\ open HKEY_CLASSES_ROOT\magnet\shell\ open\command HKEY_LOCAL_MACHINE\Software\Microsoft
\CurrentControlSet\ Control\MediaResources\icm\ VIDC.FPS1 HKEY_LOCAL_MACHINE\SOFTWARE\Fraps2 HKEY_LOCAL_MACHINE\SOFTWARE\Fraps HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Uninstall\ Fraps
C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and
at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run winxgz = "%User Profile%\zipfreerun\zipfreerun.exe autostart " Other System Modifications This Trojan deletes