Search
Keyword: microsoft internet explorer
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\{63E16148-3A71-99D9-2524-FE3574645AFF} StubPath = "%System%\ssopure.exe" Other System Modifications This Trojan adds
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run GoogleInc = "%System%\WILBERT-D08A31F.vbs" Other System Modifications This Trojan adds the following
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Netprotocol = "%User Profile%\Application Data\netprotocol.exe" Other System Modifications This spyware
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run NPJ Start = "%System%\QVYFJU\NPJ.exe" Other System Modifications This Trojan deletes the following folders: %Start Menu%\Programs\Ardamax Keylogger
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Microsoft\Dr Watson (Note:
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Microsoft\Dr Watson (Note:
to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run yiuciuou = "rundll32.exe %System Root%\yqkaou\yiuciuou.dll,FCfan
HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\RunOnce Microsoft = "%Application Data%\svchost.exe" Other System Modifications This Trojan deletes the following files: %Application Data%\svchost.exe
\WinShell\WinSeven.exe %System Root%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\taskhost.exe (Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system
Profile%\Microsoft\MSHost.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name}
HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\RunOnce Microsoft = "%Application Data%\svchost.exe" Other System Modifications This Trojan deletes the following files: %Application Data%\svchost.exe
name} on Windows Vista and 7.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows
registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Dfrg\BootOptimizeFunction LcnStartLocation = "1463841" (Note: The default value data of the said registry entry is 0 .) HKEY_LOCAL_MACHINE\SOFTWARE
registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run KB00892240.exe = "%User Profile%\Application Data\KB00892240.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ Services\6to4\Parameters ServiceDll = "antivirusupdate.dll" (Note: The default value data of the said registry entry is {random values} .) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft