Search
Keyword: microsoft internet explorer
path and file name}.doc Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application
\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and
path and file name}.doc Other System Modifications This Trojan modifies the following file(s): %Application Data%\Microsoft\Office\Word12.pip (Note: %Application Data% is the current user's Application
system is located.) Autostart Technique This spyware adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT
system is located.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup
entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\{67KLN5J0-4OPM-00WE-AAX5-74CC2A322142} StubPath = "%System Root%
ServiceDLL = "%SystemRoot%\System32\fywd.dll" (Note: The default value data of the said registry entry is {random values} .) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ DirectDraw\MostRecentApplication Name =
enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\{67KLN5J0-4OPM-61WE-KKX2-4667QWE23218} StubPath = "%System Root%\HAHAl\Raman
system is located.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup
located.) Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components
located.) Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components
enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\{67KLN5J0-4OPM-01WE-AAX2-5657QCA554112} StubPath = "%System Root%\VIDI\UNUK
system is located.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT
system is located.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT
located.) Autostart Technique This worm adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components
of itself into the affected system and executes them: %AppDataLocal%\Microsoft\Windows\{Random File Name}.exe -> Without admin rights %System%\(Random File Name}.exe -> With admin rights (Note:
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Active Setup\Installed Components\{61238F8A-87FA-422c-A14B-7419B256CDA4} stubpath = "%System%\inugvjlkd.exe" It registers as a system
{user name} on Windows Vista and 7.) Other System Modifications This spyware modifies the following file(s): %User Profile%\Application Data\Microsoft (Note: %User Profile% is the current user's profile
Profile%\Microsoft\svchost.exe.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user
execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run 33035512 = "%System Root%\{malware file name}" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows