Search
Keyword: microsoft internet explorer
\Local AppWizard-Generated Applications\ PJM\Settings HKEY_LOCAL_MACHINE\Software\Microsoft\ Active Setup\Installed Components\{random} It adds the following registry entries: HKEY_LOCAL_MACHINE\Software
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Microsoft Server Process = "%Windows%\svhst32.exe -a" Dropping Routine This Trojan drops the following
system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Windows Service Live = "ixubrmpoh.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Windows Service
\SOFTWARE\Microsoft\ Windows\CurrentVersion\Setup netinfo = "{random characters}" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ Services\netservice Description = "Ô¶³Ì¹ÜÀíÈí¼þÃèÊöÐÅÏ¢" HKEY_LOCAL_MACHINE\SOFTWARE
) Other System Modifications This Trojan adds the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ TermServMonitor It adds the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE
entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Windows LoadAppInit_Dlls = "1" It modifies the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run S17913474 = "{malware path and file name}" Other System Modifications This Trojan adds the following
every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run MyId = "{malware path and file name}" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run COUNT = "cf
every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run PAVCL = "%Windows%\muV9iWEPQVmS.exe" Other System Modifications This backdoor modifies the following registry
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Microsoft Server Process = "%Windows%\svhst32.exe -a" Dropping Routine This Trojan drops the following
its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run expcrt = "%System%\liscrts.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run start 1 = "{malware path and file name}" Other System Modifications This Trojan adds the following registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ DirectDraw\MostRecentApplication Name = "iexplore.exe" (Note: The default value data of the said registry entry is iexplore.exe .) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run RMedit = "%System%\CSDLL27.doc.exe" Other System Modifications This worm adds the following registry keys:
\Microsoft\ Windows\CurrentVersion\policies\ system EnableLUA = "0" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\policies\ system ConsentPromptBehaviorAdmin = "0" Dropping Routine This Trojan
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run registry = "%Windows%\editreg.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run MSMSGS
automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\RunOnce Avatar = " %System%\ccwap.exe 1 2" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run TrayX = "%Windows%\winppr32.exe /sinc" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run TrayX = "%Windows%\winppr32.exe /sinc" This
\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Windows Firewall = "%User Temp%\lsass.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Windows Firewall = "%User Temp%\lsass.exe" This
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run fccdabaudio = "rundll32.exe khgday.dll,s" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run