Search
Keyword: microsoft internet explorer
path and file name} Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
path and file name}.docx1 Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application
the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.) Dropping Routine This Trojan drops the following files: %Application Data%\Microsoft\Windows
path and file name} Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit),
\keys.dll Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which
Optimization Writer HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\HomeGroup\ UIStatusCache It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion
"HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{D13E3370-88BF-A0E0-B7A7-B49C0AD57D77}" /f %System%\cmd.exe /c del %User Temp%\CAB039~1.EXE > nul (Note: %User Temp% is the current user's Temp
\Programs\Startup on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.) It drops and executes the following files: %User Temp%\Rar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Microsotf = "%User Profile%\Application Data\teskmgr.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Microsotf = "%User Profile%
Windows Vista and 7.) Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows
\mobogenie_u_user_dl.mg-journal %Application Data%\Mobogenie\Source.mu %Application Data%\Mobogenie\client.time %Application Data%\Mobogenie\mobo.uuid %Application Date%\Microsoft\Internet Explorer\Quick Launch\Mobogenie.lnk
): explorer.exe userinit.exe Autostart Technique This backdoor adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Software\Administrator914\ -993627007 It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Internet Settings GlobalUserOffline = "0" HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\{C2A79DEA-9312-EF19-1BC6-EE213BC2F85D} StubPath = "%System\jqsrv.exe%" (for accounts with Admin Rights) HKEY_CURRENT_USER\SOFTWARE\Microsoft
at any one time: system32 Autostart Technique This backdoor adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows
Spy drops the following copies of itself into the affected system: %AppDataLocal%\Microsoft\Windows\{string 1}{string 2}.exe - drops the file here if it has no admin privileges %System%\{string 1}
and 10(64-bit).) Autostart Technique This Trojan Spy adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows