Search
Keyword: browser hijacker
Bromium Nichrome Comodo RockMelt K-Meleon Epic Browser FastStone Browser Stolen Information This spyware sends the gathered information via HTTP POST to the following URL: http://{BLOCKED}g.{BLOCKED
such as user names, passwords, and hostnames from the following browsers: Opera Mozilla Firefox SeaMonkey Flock Google Chrome Chromium ChromePlus Bromium Nichrome Comodo RockMelt K-Meleon Epic Browser
automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\explorer\ Browser Helper Objects\
every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\
\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{CE7C3CF0-4B15-11D1-ABED-709549C10000} It registers as a system service to ensure its automatic execution at every system startup by adding
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{54FBB5AD-5F1A-41BC-B884-7A198AAE6956}
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{14EAF723-CAAC-42CE-BA4D-F69DC3A4A838}
This Trojan acts as a Browser Helper Object (BHO) that monitors a user's Internet-browsing habits. Installation This Trojan drops the following files: %User Profile%\Application Data\Toolbar4\
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{79848780-3218-4973-9C99-627926B6F4A4}
SpeedUpMyPC Wajam LampyLighty Vuupc Mystartsearch Omiga Plus Check Me Up Browser app Media Player Enhance It displays installation options and EULAs of the software: After downloading, it will display ads in
}/{hex} http://{BLOCKED}erheg.ru/stats/00/counter/{hex}/{hex} http://{BLOCKED}wasmuch.ru/stats/00/counter/{hex}/{hex} As of this writing, the said sites are inaccessible. Web Browser Home Page and
passwords, and hostnames from the following browsers: Opera Mozilla Firefox SeaMonkey Flock Google Chrome Chromium ChromePlus Bromium Nichrome Comodo RockMelt K-Meleon Epic Browser FastStone Browser Stolen
\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{94EA03C3-5988-4428-A5BF-5AB34C82C806} Other System Modifications This worm adds the following registry entries as part of its installation
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}
itself It connects to the following URL(s) to send and receive commands from a remote malicious user: http://{BLOCKED}deme.ru/img/order.php Web Browser Home Page and Search Page Modification This backdoor
%User Profile%\_NEMTY_{7 random characters}_.nemty (Note: %Cookies% is the Internet Explorer browser cookies folder, which is usually C:\Documents and Settings\{user name}\Cookies on Windows 2000
Chromium ChromePlus Bromium Nichrome Comodo RockMelt K-Meleon Epic Browser FastStone Browser Stolen Information This spyware sends the gathered information via HTTP POST to the following URL: http://{BLOCKED
Microsoft Silverlight. The vulnerability could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs) or
\Explorer\ Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} Other System Modifications This spyware deletes the following files: %User Temp%\RarSFX0\apps.dat %User Temp%\RarSFX0\pk.bin %User Temp
\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{8a194578-81ea-4850-9911-13ba2d71efbd} Other System Modifications This spyware deletes the following files: %Windows%\Microsoft.NET\Framework