Search
Keyword: microsoft internet explorer
2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.) It modifies the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Dfrg\BootOptimizeFunction LcnStartLocation =
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 7c2bb55 = "%System Root%\7c2bb55f\7c2bb55f.exe" HKEY_CURRENT_USER\Software
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 3ead42b = "%System Root%\3ead42b5\3ead42b5.exe" HKEY_CURRENT_USER\Software
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 96fe70 = "%System Root%\96fe70f\96fe70f.exe" HKEY_CURRENT_USER\Software
Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run windows = "%User
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 134f93e = "%System Root%\134f93e9\134f93e9.exe" HKEY_CURRENT_USER\Software
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 67a5016 = "%System Root%\67a50162\67a50162.exe" HKEY_CURRENT_USER\Software
2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.) It modifies the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Dfrg\BootOptimizeFunction LcnStartLocation =
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 752797a = "%System Root%\752797a0\752797a0.exe" HKEY_CURRENT_USER\Software
entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 286bac8 = "%System Root%\286bac8f\286bac8f.exe" HKEY_CURRENT_USER\Software
HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Server = "%User Profile%\Application Data\Server.exe " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Server = "%User Profile%
Profile%\Microsoft\hkgdt.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name}
Profile%\Microsoft\Payment.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 29a57c = "%System Root%\29a57cc\29a57cc.exe" HKEY_CURRENT_USER\Software
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run a3c12c = "%System Root%\a3c12c8\a3c12c8.exe" HKEY_CURRENT_USER\Software
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run 420494 = "%System Root%\4204944\4204944.exe" HKEY_CURRENT_USER\Software
registry entries to ensure it automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Winlogon Userinit = "%System%\userinit.exe,%User Temp%\leass.exe,"
Profile%\Microsoft\Money2.exe (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name}
to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run ca9709 = "%System Root%\ca97093\ca97093.exe" HKEY_CURRENT_USER\Software
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\RunOnce Microsoft = "%Application Data%\svchost.exe" Other System Modifications This Trojan deletes the