Search
Keyword: vb
Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z
Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z
\Software\VB and VBA Program Settings\ x\z It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced ShowSuperHidden = "0" HKEY_LOCAL_MACHINE
following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ 0\0 It adds the following registry entries: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ 0\0 0 = "0
\RunServices win = "%User Temp%\wocualts.exe" Other System Modifications This worm adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ tob Propagation This worm drops the
.rar): cmd /c {directory of WinRAR} vb "{All Drives}\{Directory of archive}\{Name of archive(.zip or .rar)}" lpk.dll | find /i "lpk.dll" {directory of WinRAR} x "{All Drives
on Windows 2000, XP, and Server 2003.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ mm\5 It adds the following registry entries: HKEY_CURRENT_USER
Settings\{user name} on Windows 2000, XP, and Server 2003.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ mm\5 HKEY_CURRENT_USER\Software\Classes\ clsid
the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ mm\5 HKEY_CURRENT_USER\Software\Classes\ clsid HKEY_CURRENT_USER\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}
following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced
\{user name} on Windows Vista and 7.) It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ x\z HKEY_CURRENT_USER\Software\Classes\ clsid HKEY_CURRENT_USER\clsid
following files: {malware path and file name}:zone.identifier It adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ Microsoft\Sysinternals HKEY_LOCAL_MACHINE\SOFTWARE
mkv 3gp mp4 mov avi asf mpeg vob mpg wmv fla swf wav mp3 sh class jar java rb asp php jsp brd sch dch dip pl vb vbs ps1 bat cmd js asm h pas cpp c cs suo sln ldf mdf ibd myi myd frm odb dbf db mdb accdb
tga tgz thm tif tiff tmp torrent ttf txt vb vcf vcxproj vob wav wma wmv wpd wps xhtml xla xlam xls xlsb xlsm xlsx xltx xml xps yuv zip zipx It appends the following extension to the file name of the
txt vb vcproj vbs wa v wma wv xml xsd xsl xslt It renames encrypted files using the following names: {original file name and extension}.encrypted However, as of this writing, the said sites are
st5 st6 st7 st8 std sti stw stx svg swf sxc sxd sxg sxi sxm sxw tex tga thm tif tlg txt vb vbs vmdk vmem vmsd vmsn vmx vmxf vob wallet war wav wb2 wmv wpd wps x11 x3f xis xla xlam xlk xlm xlr xls xlsb
class cpp cs h java lua pl py sh sln swift vb vcxproj dem gam nes rom sav tgz zip rar tar 7z cbr deb gz pkg rpm zipx iso ged accdb db dbf mdb sql fnt fon otf ttf cfg ini prf bak old tmp torrent It
\Software\VB and VBA Program Settings\ x\z It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced ShowSuperHidden = "0" HKEY_LOCAL_MACHINE
\CurrentControlSet\ services\svchost Other System Modifications This Trojan deletes the following files: {malware path and file name}:zone.identifier It adds the following registry keys: HKEY_CURRENT_USER\Software\VB
Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ CLOCK\SData It adds the following registry entries: HKEY_CURRENT_USER\Software\VB and VBA