Search
Keyword: browser hijacker
every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\
2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista and 7.) Web Browser Home Page and Search Page Modification This Trojan modifies
its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\
every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\
every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\
\Microsoft\ Windows\CurrentVersion\policies\ system EnableLUA = "0" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects NoExplorer = "1" Dropping Routine This Trojan
\Microsoft\ Windows\CurrentVersion\policies\ system EnableLUA = "0" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects NoExplorer = "1" Dropping Routine This Trojan
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\explorer\ Browser Helper Objects\{F770522B-198D-4134-9D74-D30F41B3BA44}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3} Other Details This Trojan connects to the following possibly malicious URL: http://
\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{C41A1C0E-EA6C-11D4-B1B8-444553540000} This report is generated via an automated analysis system. TrojanSpy:Win32/Bancos.MB
{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.) It adds the following registry entries: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ Services\FireFox Description = "FireFox Browser
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{16C6167B-FED4-4CEE-8951-134C9A345DA2}
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\explorer\ Browser Helper Objects\{FB3412B6-6D67-4650-B3B4-C2A90191A80F}
NVCUpgrader.npc (Naver Upgrader) NaverAgent.exe (Naver Agent) AvastSvc.exe (AVAST antivirus Service) avsx.exe (AVAST Browser Antispyware) AvastUI.exe (AVAST UI) ashUpd.exe (AVAST Updater) avp.exe (Kaspersky
Arrival Details This Trojan may be dropped by other malware. Installation This Trojan adds the following processes: default browser process It creates the following folders: %Application Data%\
\CurrentVersion\Explorer\ Browser Helper Objects\{83447388-F457-4723-9D09-6F486F161E1A} NoExplorer = "dword:00000001" TrojanSpy:Win32/Bancos.AEV (Microsoft)
) - visit url using the affected system's default web browser It connects to the following websites to send and receive information: http://{BLOCKED}ss.net/winupdate It posts the following information
{value}ver={version}tm={value}src=ds&p= http://www.{BLOCKED}search.net?sid={sysid}aid={appid}itype={value}ver={version}tm={value}src=hmp It does the following: It may download and install Linkey browser
following: "Buy BitCoins" button will open a browser window which opens the site "https://buy.bitcoin.com/" Entering "Key" on the Enter Decryption Key field and pressing "Unlock My Windows" re-enables task
\Classes\ MJ CLSID = "{Random Hex Values}" Web Browser Home Page and Search Page Modification This Trojan modifies the Internet Explorer Zone Settings. Other Details This Trojan connects to the following