Search
Keyword: microsoft internet explorer
\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f %System%\svchost.exe -k DcomLaunch %System%\lsass.exe (Note: %User Temp% is the current user's Temp folder, which is
\LastGood.Tmp %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db (Note: %Windows% is the Windows folder, where it
C:\ on all Windows operating system versions.) It creates the following folders: %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft (Note: %Windows% is the Windows folder, where it
Windows operating system versions.) It creates the following folders: %System Root%\cfgPath4 %System Root%\cfgPath3 %System Root%\cfgPath1 %System Root%\cfgPath2 %User Profile%\Application Data\Microsoft
\Software\Microsoft\ RestartManager\Session0000 Owner = "\x08\x00\x00\xe2\xee\xaaK\xa3\xc6\xd5\x01" HKEY_CURRENT_USER\Software\Microsoft\ RestartManager\Session0000 SessionHash = "{random characters}
/N /D Y /T 15 It creates the following folders: %User Profile%\Application Data\Microsoft\Forms %System Root%\Users\Public\tmpdir (Note: %User Profile% is the current user's profile folder, which is
" /XML "%User Temp%\tmp9F1B.tmp" REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f %System%\lsass.exe (Note: %User Temp% is the current user's
following processes: schtasks.exe /Create /TN "Updates\uSaQfh" /XML "%User Temp%\tmp68C0.tmp" "%User Temp%\02d0f1e90aa3f349f78b3000e0e85b1634da1a8d.exe" dw20.exe -x -s 948 REG add HKCU\Software\Microsoft
is C:\Windows on all Windows operating system versions.) It adds the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\NetworkList\ Nla\Cache\Intranet
\Software\Microsoft\Windows\CurrentVersion\Run /f /v winservie /t REG_SZ /d %System%\pcalua.exe" -a %Application Data%\winservie.exe" %Application Data%\winservie.exe "%User Temp%\InstallUtil.exe" %System%
\tmpdir\winlogon.exe %System Root%\Users\Public\tmpdir\winlogon.exe It creates the following folders: %User Profile%\Application Data\Microsoft\Forms %System Root%\Users\Public\tmpdir (Note: %User Profile%
\Microsoft\ Windows\CurrentVersion\Run {Malware name} = “wscript.exe //B "%Application Data%\{Malware name}.vbs"” HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run nXDLKezaVy = “wscript.exe //B
following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 8f34728f80df8c32c623d3fce57aa5c31153be42 = "wscript.exe
Profile%\Microsoft\Network\Downloader\qmgr1.dat %All Users Profile%\Microsoft\Windows\DRM\drmstore.hds %AppDataLocal%\GDIPFONTCACHEV1.DAT %All Users Profile%\Microsoft\Windows\DRM\v3ks.sec %AppDataLocal%
%\uBXFgHOTN.exe %AppDataLocal%\Microsoft\Media Player\CurrentDatabase_372.wmdb %All Users Profile%\Microsoft\Windows\DRM\v3ks.sec %AppDataLocal%\GDIPFONTCACHEV1.DAT %All Users Profile%\Microsoft
Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).) Other System Modifications This Trojan Spy deletes the following files: %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft
\ServiceProfiles\NetworkService\AppData\Local\Microsoft (Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.) Autostart Technique This Trojan Spy registers
C:\ on all Windows operating system versions.) It creates the following folders: %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft %Application Data%\737FF7 (Note: %Windows% is the
is C:\Windows on all Windows operating system versions.) It adds the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\NetworkList\ Nla\Cache\Intranet
folder, where it usually is C:\ on all Windows operating system versions.) It creates the following folders: %Application Data%\737FF7 %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft (Note: