Search
Keyword: vb
\CurrentVersion\Run paunep = "%User Profile%\paunep.exe /b" Other System Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z HKEY_CURRENT_USER
\Classes\ CLSID\{F557BA3D-A7B9-82B1-467C-B49AA78208E8}\ProgID HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ tob\x It adds the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
VB (McAfee); Trojan Horse (Symantec); Trojan.Win32.VB.de, Trojan.Win32.VB.de (Kaspersky); Trojan.Win32.VB (Sunbelt); Trojan.VB.DE (FSecure)
files: %Temp%\scs4.tmp %Temp%\scs7.tmp (Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program
\Software\VB and VBA Program Settings\ Service Manager\Service Manager HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Time Zones\ PM It adds the following registry entries: HKEY_LOCAL_MACHINE
interface, and requires a third party tool should the user want to unhide it. With the macro being inside the spreadsheet, this cannot be viewed from the VB Macro window. Microsoft Excel provides a feature to
\SOFTWARE\Classes\ Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\TypeLib Version = "1.0" HKEY_CLASSES_ROOT VBScript = "VB Script Language" HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ VBScript CLSID = "
following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced
\CurrentVersion\Run nuaitus = "%User Profile%\nuaitus.exe /c" Other System Modifications This worm deletes the following folders: 0 It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program
on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings
\CurrentVersion\Run diuopih = "%User Profile%\diuopih.exe /c" Other System Modifications This worm adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ 0\0 It adds the following
on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ Microsoft\Exe Name.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ ESENT\Process\Windows Update HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ ESENT\Process\Windows Update
keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ Microsoft\Sysinternals HKEY_CURRENT_USER\Software\Microsoft\ Windows\Currentversion\RunOnce It adds the following registry entries:
{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\OLEScript It adds the following registry entries: HKEY_CURRENT_USER\Software\3721\ CnsMin IIS = "&fb=0&fc=0&fd=0&fe=0&fg=0&fh=0&fi=0&fj=0&fa=0&fu=" HKEY_CLASSES_ROOT VBScript = "VB Script Language
\Policies\ Explorer\Run VB and VBA Program Settings = %Application Data%\{random}\{random filename}.exe Other Details This Trojan connects to the following possibly malicious URL: http://{BLOCKED
It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z HKEY_CURRENT_USER\Software\Classes\ clsid HKEY_CURRENT_USER\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}
Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z
It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z HKEY_CURRENT_USER\Software\Classes\ clsid HKEY_CURRENT_USER\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}
the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z HKEY_CURRENT_USER\Software\Classes\ clsid HKEY_CURRENT_USER\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}