Search
Keyword: browser hijacker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{21608B66-026F-4DCB-9244-0DACA328DCED} Other System Modifications This Trojan deletes the following files: %User Temp%
Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{21608B66-026F-4DCB-9244-0DACA328DCED} Other System
Browser Flock Browser RockMelt K-Meleon FastStone Browser This spyware uses the following list of user names and passwords to access password-protected locations where the aforementioned information are
the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2} Other System Modifications This Trojan
any one time: DC_MUTEX-B2FTUQZ It stays memory-resident by injecting codes into the following processes: RegSvcs.exe (v2.0.50727) RegSvcs.exe (v4.0.30319) Default Internet Browser (e.g. iexplore.exe,
used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{DAF9F01C-30F0-4A52-AF52-E236961977F4} It registers as a system
retrieve stored information such as user names, passwords, and hostnames from the following browsers: Google Chrome Mozilla Firefox Internet Explorer Opera Browser Flock Browser RockMelt K-Meleon FastStone
by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{DAF9F01C-30F0-4A52-AF52-E236961977F4} It registers as a system
by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{DAF9F01C-30F0-4A52-AF52-E236961977F4} It registers as a system
by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{AB705622-B25B-491B-A6BF-4A46FDDBC88E} It registers as a system
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{671E8874-E352-4D06-8D35-A3E181C16538}
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{189032F2-3C17-4415-A014-5E239C3BEE3E}
as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Browser
BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper
\CurrentVersion\Explorer\ Browser Helper Objects\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} It adds the following registry entries to install itself as a Browser Helper Object (BHO): HKEY_CLASSES_ROOT\CLSID\
System Modifications This Trojan adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Internet Explorer\Main Enable Browser Extensions = yes HKEY_CURRENT_USER\Software\Microsoft
dropped by other malware. Autostart Technique This Trojan adds the following registry keys to install itself as a Browser Helper Object (BHO): HKEY_CLASSES_ROOT\main.BHO HKEY_CLASSES_ROOT\main.BHO.1
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{79B7C870-3FA2-4410-A297-9AC5D1A407D2}
Backdoor Routine This backdoor executes the following commands from a remote malicious user: !storage! – retrieves the stored passwords of the browser where this malware is running, and sends it to the C&C
Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{random CLSID} Other System Modifications This Trojan