Search
Keyword: microsoft internet explorer
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Modem = "%System Root%\{malware file name}.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run S1551321 = "{malware path and file name}" Other System Modifications This Trojan adds the following registry
are legitimate. Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows
every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\RunServices by pornoman = "%System Root%\porno.scr" Other System Modifications This worm adds the following registry
following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ RFC1156Agent\CurrentVersion\Parameters It adds the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ RFC1156Agent
every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run MyApp = "%System%\SVCHOST32.EXE" Other System Modifications This worm adds the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ DirectDraw\MostRecentApplication Name = "{malware file name}" (Note: The default value data of the said registry entry is iexplore.exe .) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\SOFTWARE\Microsoft\ Security Center UACDisableNotify = "0" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\policies\ system EnableLUA = "0" This report is generated via an automated analysis
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run IEExtension = "{malware path and file name}" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center AntiVirusOverride = "1" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center FirewallOverride = "1" Other Details This Trojan connects to the following possibly
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run S3311515 = "{malware path and file name}" Other System Modifications This Trojan adds the following registry
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run asaecc = "%Program Files%\uninstall information\aecch.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows
\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Image File Execution Options\ my.exe It adds the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Image File
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run FireFoxStr ServerTool = "{Malware path and file name}.exe" - if affected machine has Admin rights
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run GMAIL SERVERPRO = "{Malware path and file name}.exe" - if affected machine has Admin rights
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run GMAIL SERVERPRO = "{Malware path and file name}.exe" - if affected machine has Admin rights
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run FILEFITOR SERVER = "{Malware path and file name}.exe" - if affected machine has Admin rights
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run NAJYSDYSKSK = "{Malware path and file name}.exe" - if affected machine has Admin rights HKEY_CURRENT_USER
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run FireFoxStr ServerTool = "{Malware path and file name}.exe" - if affected machine has Admin rights
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run GMAIL SERVERPRO = "{Malware path and file name}.exe" - if affected machine has Admin rights