Search
Keyword: microsoft internet explorer
\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.) It creates the following folders: %Start Menu%\Programs\AVASoft Professional Antivirus {All User's Profile}\Application Data\{random
\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.) It creates the following folders: %Start Menu%\Programs\AVASoft Professional Antivirus {All User's Profile}\Application Data\{random
Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\RunOnce Shell = "%User Profile%
Settings\Wilbert \Documents and Settings\Wilbert\9mxb41672eo75b %User Profile%\Microsoft\Backups (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Audiodgi = "%User Profile%\AudioSettings\Audiodgi.exe" Other System Modifications This Trojan modifies the
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Audiodgi = "%User Profile%\AudioSettings\Audiodgi.exe" Other System Modifications This Trojan modifies the
entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {8 character string} = "%Application Data%\{8 character string}\{8
following files: %Application Data%\Microsoft\Address Book\{computer name}.wab %Application Data%\{random folder name 2}\{random filename 2}.{random extension} (Note: %Application Data% is the Application
Server 2012.) It drops the following copies of itself into the affected system: %Application Data%\Microsoft\Catstion\api-OKSE.exe (Note: %Application Data% is the Application Data folder, where it usually
name} on Windows Vista and 7.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows
creates the following folders: %User Profile%\Application Data\Microsoft\Forms (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows
system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.) It creates the following folders: %Windows%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP
%System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.) It creates the following folders: %User Profile%\Application Data\Microsoft\Forms
versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.) It creates the following folders: %User Profile%\Application Data\Microsoft
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Application Data\Microsoft
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Application Data\Microsoft
\Microsoft\Windows\DRM\v3ks.sec %AppDataLocal%\GDIPFONTCACHEV1.DAT %All Users Profile%\Microsoft\Windows\DRM\drmstore.hds %All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat %All Users Profile%
SNMP Server 1009115* - Microsoft Windows SNMP Service Denial of Service Vulnerability (CVE-2018-0967) SSH Client 1008580* - OpenSSH Client Multiple Security Vulnerabilities VoIP Smart 1008941* - Asterisk
HKEY_CURRENT_USER\Keyboard Layout 2 = "{hex values}" HKEY_CURRENT_USER\Software\Microsoft\ Windows {Volume Serial Number} = "{hex values}" Download Routine This Worm connects to the following URL(s) to download its
Data%\Microsoft\Internet Explorer\Quick Launch\PDFsam Enhanced 7.lnk %Program Files%\PDFsam Enhanced 7\resources\Core\Encodings\AdobeExpertEncoding %Program Files%\PDFsam Enhanced 7\resources\Core