Search
Keyword: microsoft internet explorer
\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.) It adds the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows
\Users\{user name} on Windows Vista and 7.) It creates the following folders: %User Profile%\Microsoft\Backups (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and
\Users\{user name} on Windows Vista and 7.) It creates the following folders: %User Profile%\Microsoft\Backups (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and
Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run AdvanceElite = "%User
Profile%\Microsoft\atiesrx.exe (Note: %User Profile% is a user's profile folder, where it usually is C:\Documents and Settings\{user name} on Windows 2000, Windows Server 2003, and Windows XP (32- and
Profile%\Microsoft\atiesrx.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name
Profile%\Microsoft\atiesrx.exe (Note: %User Profile% is a user's profile folder, where it usually is C:\Documents and Settings\{user name} on Windows 2000, Windows Server 2003, and Windows XP (32- and
Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and
Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows XP, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.
itself into the affected system: D:\Windows Component\defender.exe %Application Data%\Microsoft\Network\srcc.exe %Application Data%\Microsoft\Windows\audiohq.exe (Note: %Application Data% is the current
{random file name 1} %Application Data%\{random folder}\{random file name 2} %Application Data%\{random folder}\{random file name 3} %AppDataLocal%Low\Microsoft\CryptnetUrlCache\MetaData
\Users\{user name} on Windows Vista and 7.) It creates the following folders: %User Profile%\Microsoft\Backups (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and
\Users\{user name} on Windows Vista and 7.) It creates the following folders: %User Profile%\Microsoft\Backups (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and
\Users\{user name} on Windows Vista and 7.) It creates the following folders: %User Profile%\Microsoft\Backups (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and
Profile%\Microsoft\Infter.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name}
Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.) Autostart Technique This Trojan adds the following registry entries to enable
\Users\{user name} on Windows Vista and 7.) It creates the following folders: %User Profile%\Microsoft\Backups (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and
Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.) It adds the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion
following folders: %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft (Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.) Autostart
the following folders: %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft (Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)