Search
Keyword: microsoft internet explorer
startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random} = "rundll32.exe {malware path and filename},Startup" Other System Modifications This Trojan adds the following registry
HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random} = rundll32.exe "{malware path and filename}",Startup Other System Modifications This Trojan adds the following registry keys as part of its
\Software\Microsoft\ Windows\CurrentVersion\Run {random} = rundll32.exe "{malware path and file name}",Startup Other System Modifications This Trojan adds the following registry entries: HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Winlogon Shell = Explorer.exe IEXPLORER.exe HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Yahoo Messengger = %System%\IEXPLORER.exe
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 4b5c01a9cf7d0dbef541851f25684831 = "%User Profile%\Application Data\Important.exe" Other System
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 68cf494c1d338a8104a747afef281b4c = "%User Profile%\Application Data\Important.exe" Other System
%User Profile%\Microsoft\Backups (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user
the following registry keys: HKEY_CURRENT_USER\Software\DC3_FEXEC It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows NT\CurrentVersion\Winlogon shell = "%User Temp%
administrators session /ADD reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_{random numbers}_toolbar" /t "REG_SZ" /d {Malware File Name} /f reg add HKCU\Software\Microsoft\Windows
records: Master boot record Volume boot record It takes advantage of the following software vulnerabilities to elevate its escalation privileges: Microsoft Windows AFD Driver Local Privilege Escalation
\Microsoft\ Windows\CurrentVersion\Run mmva = %System%\mmvo.exe Win32:Oliga [Trj] (Avast); Worm:Win32/Taterf.B (Microsoft); W32.Gammima.AG (Norton) Downloaded from the Internet, Dropped by other malware Drops
\Microsoft\ Windows NT\CurrentVersion\Winlogon Shell = "explorer.exe "%User Profile%\Application Data\bmgonsc3tkjk3qwlvtnksgvdhizuhja\csrss.exe"" (Note: The default value data of the said registry entry is
system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run svchost = "%User Profile%\Application Data\svchost.exe" It modifies the following registry entries to ensure it automatic
time: zentoworld_07753191_dada Autostart Technique This Trojan modifies the following registry entries to ensure it automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Winlogon Shell = "explorer.exe "%Application Data%\{random alphanumeric characters}\csrss.exe"" (Note: The default value data of the said registry entry
\Microsoft\ Windows\CurrentVersion\Run {random 7 characters} = "%System Root%\{random 8 characters}\{random 8 characters}.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random 8
\Microsoft\ Windows\CurrentVersion\Run {random 7 characters} = "%System Root%\{random 8 characters}\{random 8 characters}.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random 8
This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random 7 characters} = "
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random 7 characters} = "%System Root%\{random 8 characters}\{random 8 characters}.exe" HKEY_CURRENT_USER
\Microsoft\ Windows\CurrentVersion\Run {random 7 characters} = "%System Root%\{random 8 characters}\{random 8 characters}.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random 8