Search
Keyword: microsoft internet explorer
7.) Other System Modifications This spyware modifies the following file(s): %User Profile%\Application Data\Microsoft (Note: %User Profile% is the current user's profile folder, which is usually C:
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Network List Service = "%User Profile%\Windows\AeLookupSvc.exe" HKEY_CURRENT_USER\Software\Microsoft
system versions.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows
automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run HKLM = "%System%\System32\csrss.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion
64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows
64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows
64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows
64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows
64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows
\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run {Malware Name} = %AppDataLocal%\{Malware Name}.exe HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {Malware Name} = %AppDataLocal%\{Malware
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Application Data\Microsoft
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Application Data\Microsoft
following processes: "{malware file path and name}" REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f %System%\lsass.exe (Note: %System% is the
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Application Data\Microsoft
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Application Data\Microsoft
\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run {Malware Name} = %AppDataLocal%\{Malware Name}.exe HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {Malware Name} = %AppDataLocal%\{Malware
the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ RestartManager\Session0000 It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ RestartManager\Session0000
and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).) Other System Modifications
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Host Process for Windows Services = "%Application Data%\svchost\svchost.exe
file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Installation This Trojan creates the following folders: %User Profile%\Application Data\Microsoft