Search

following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{F12C6330-5585-4DE6-8650-8C11285AA2C1} Other System Modifications This spyware adds the

following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{F12C6330-5585-4DE6-8650-8C11285AA2C1} Other System Modifications This spyware adds the

time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{4B07B8E2-B467-358D-B343-06A8930F9912}

\MICROSOFT\Windows\CURRENTVERSION\Explorer\Browser Helper Objects\{8327886C-C208-408B-AD90-B3EE40C42947} (Default)=extremeupobj HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\Explorer\Browser

\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.) It queries the default web browser by accessing the following registry entry: HKEY_CLASSES_ROOT\http\shell\open\command

and file name}" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\ldinihyu\Parameters ServiceMain = "DllRegisterServer" It adds the following registry keys to install itself as a Browser Helper

Browser Helper Object (BHO): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{60972418-8A4B-B5CC-3C3D-0587F39623FF} The scheduled task executes the malware at

This backdoor starts a hidden default browser. It injects codes in the hidden default browser to perform its backdoor routines. This backdoor arrives on a system as a file dropped by other malware or

\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\ Other System Modifications This Trojan adds the following registry keys: HKEY_CLASSES_ROOT\BarNews.ClsBarNews\Clsid

routines of the downloaded files are exhibited on the affected system. NOTES: It registers the downloaded file as Browser Helper Object (BHO) by adding the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\ Other System Modifications This Trojan deletes the following files: %System Root%\newplay2.zip (Note: %System Root% is

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\ Other System Modifications This Trojan adds the following registry keys: HKEY_CLASSES_ROOT\Trivela.ClsTrivela\Clsid

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\ Other System Modifications This Trojan deletes the following files: %System Root%\sw2.zip (Note: %System Root% is the

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\ Other System Modifications This Trojan deletes the following files: %System Root%\pic2.zip (Note: %System Root% is the

following browsers: Chrome ChromePlus Chromium FastStone Browser Flock Internet Explorer K-Meleon Mozilla Firefox Opera Browser Stolen Information This spyware sends the gathered information via HTTP POST to

ensure its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\

\Software\Description\ Microsoft\Rpc\UuidTemporaryData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects HKEY_CURRENT_USER\SOFTWARE\Microsoft\ Windows

http://www.mozilla.org/security/announce/2008/mfsa2008-60.html Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption

ensure its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\

adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\ Other System Modifications This Trojan adds the following registry keys: