Search
Keyword: microsoft internet explorer
\SOFTWARE\Microsoft\ Windows\CurrentVersion\policies\ system EnableLUA = "0" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center UacDisableNotify = "1" Dropping Routine This Trojan drops the following
every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Sumanya = "%Windows%\debug\winlng.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Sumanya = "
registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ DirectDraw\MostRecentApplication Name = "{malware file name}" (Note: The default value data of the said registry entry is iexplore.exe .)
adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Policies\ System It creates the following registry entry(ies) to disable Task Manager, Registry Tools and
adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Policies\ System It creates the following registry entry(ies) to disable Task Manager, Registry Tools and
\SOFTWARE\Microsoft\ Windows\CurrentVersion\policies\ system EnableLUA = "0" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Security Center UacDisableNotify = "1" Dropping Routine This Trojan drops the following
CVE-2010-1900,CVE-2010-1901,CVE-2010-1902,CVE-2010-1903 This security update addresses four Microsoft Office vulnerabilities that could allow remote code execution once a user opens a specially
* indicates a new version of an existing rule Deep Packet Inspection Rules: FTP Server WarFTPd 1003718* - WarFTP Daemon Format String Denial Of Service Microsoft Office 1008746* - Microsoft Office
{Malware File Name}.reg" Other System Modifications This Trojan adds the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ Microsoft\Windows Defender DisableAntiSpyware = 1 (Note: The default
Modifications This worm adds the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\Security Center\Svc HKEY_CURRENT_USER\Software\FirstRRRun It adds the following registry entries:
entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run cmd.exe = %system%\cmd.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run {malware name} = "{malware path}\{malware name}.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %Program Files%\Microsoft ActiveSyncs
the affected system: %User Profile%\Microsoft\torrent.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT
Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.) It adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ Windows
following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run System = "%System%\kernels32.exe" Other System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run ctfmon = "{malware path and file name}
\Software\Microsoft\ Windows\CurrentVersion\Run Adobe CSS5.1 Manager = "{random characters}" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\RunOnce Adobe CSS5.1 Manager = "{random characters}
file name}_ Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run
Modifications This worm adds the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\Security Center\Svc HKEY_CURRENT_USER\Software\FirstRRRun It adds the following registry entries: