Search
Keyword: microsoft internet explorer
following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe
Installation This backdoor drops the following copies of itself into the affected system: %Application Data%\Microsoft\Crypto\RSA\-1131521333.dll (Note: %Application Data% is the current user's Application Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run update.exe = "%Application Data%\update.exe" Other System Modifications This Trojan modifies the following file(s): %System%\drivers\etc\hosts (Note:
every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\RunOnce winloader = "%Windows%\Driver Cache\Winapp\AppData\lssass.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows
automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612} StubPath = "{random characters}" Other System
\Software\Microsoft\ Windows\CurrentVersion\Run Client Server Runtime Process = "%User Profile%\Application Data\csrss.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Host-process
entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe" HKEY_LOCAL_MACHINE\SOFTWARE
\Software\Microsoft\ Windows\CurrentVersion\Run Client Server Runtime Process = "%User Profile%\Application Data\csrss.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Host-process
\WinShell\WinSeven.exe %System Root%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\taskhost.exe (Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating
entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe" HKEY_LOCAL_MACHINE\SOFTWARE
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run java update = "%Application Data%\_xx_java.exe" Other System Modifications This backdoor adds the following
following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe
\WinShell\WinSeven.exe %System Root%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\taskhost.exe (Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system
following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Security = "%User Temp%\winlogin.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Configuring = "rundll32.exe %User Temp%\184968.txt,ins" Other System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run ctfmon = "{malware path and file name}
Windows Vista and 7.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_USERS\{SID}\Software\ Microsoft\Windows
\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run avpupdt = "%System%\1718185808\avgupdt.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run ctfmon = "{malware path and file name}
and 7.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run