Search
Keyword: microsoft internet explorer
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Microsoft\Dr Watson (Note:
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Microsoft\Dr Watson (Note:
Modifications This Trojan adds the following registry entries as part of its installation routine: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Windows LoadAppInit_DLLs = 1 HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER\Software\Microsoft\ Bind It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Bind comment = "3913273" HKEY_CURRENT_USER\Software\Microsoft\ Bind comment2 = "f" Dropping
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Netprotocol = "%User Profile%\Application Data\netprotocol.exe" Other System Modifications This Trojan adds
Profile%\Application Data\Microsoft\IME\V2002\PHIME2002A.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT
the following copies of itself into the affected system: %User Profile%\Application Data\Microsoft\winlogon.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Windows
This specially crafted RTF file takes advantage of a vulnerality in certain versions of Microsoft Office to download another malicious file that Trend Micro detects as BKDR_TURKOJAN.JF. As a result,
vulnerabilities to drop malicious files: Microsoft Microsoft Windows Help and Support Center Download Routine After successfully exploiting the said vulnerability, this malware connects to the following URLs to
startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Client Server Runtime Process = "%Application Data%\csrss.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run
to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run 75840345 = "rundll32.exe %System Root%\784220\75840345.dll,MaoDalian
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run JUNIUKVC = "%System Root%\{malware file name}" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows
startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run winlogin = "%User Temp%\winlogin.exe" Other System Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER
\Software\Microsoft\ Windows\CurrentVersion\Run Client Server Runtime Process = "%User Profile%\Application Data\csrss.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Host-process
\WinShell\WinSeven.exe %System Root%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\taskhost.exe (Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating
\WinShell\WinSeven.exe %System Root%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\taskhost.exe (Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This backdoor creates the following folders: %User Profile%\Microsoft\Dr Watson
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Microsoft\Dr Watson (Note:
system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\RunServices USBDevice = "%System%\USBDevice.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\RunServices
where the operating system is located.) Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft