Search
Keyword: browser hijacker
Identity" HKEY_CURRENT_USER\Software\Microsoft\ {Random Key Name} {Random Name} = "{Random Hex Values}" Web Browser Home Page and Search Page Modification This worm modifies the Internet Explorer Zone
{Random File Name 2}.exe = "%Application Data%\{Chosen Folder}\{Random File Name 1}.exe" Web Browser Home Page and Search Page Modification This Trojan modifies the Internet Explorer Zone Settings. Other
Ordinal = "2" (Note: The default value data of the said registry entry is 1 .) Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. Other Details
following registry entries: HKEY_CURRENT_USER\Software\Policies\ Microsoft\Windows\System DisableCMD = "0" HKEY_LOCAL_MACHINE\SYSTEM\InfoTime InfoTime = "{date}" Web Browser Home Page and Search Page
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}
installation routine: HKEY_CURRENT_USER\Software\Microsoft\ {random} Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. PWS:Win32/Zbot.gen!Y (Microsoft)
(DOWNLOAD) - Downloads and execute arbitrary file (EXEC) - Executes command (GET) - Sends GET floods (HELP) - Print Commands (OPENURL) - Opens a URL using a hidden browser (POST) - Sends POST floods
\ Browser Helper Objects\{110E25E1-8103-4368-8662-B1188985D70A} Other System Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER\SOFTWARE\Microsoft\ Windows\CurrentVersion\Policies
Downloads and execute arbitrary file (EXEC) - Executes command (GET) - Sends GET floods (HELP) - Print Commands (OPENURL) - Opens a URL using a hidden browser (POST) - Sends POST floods (QUIT) - Terminate
\ Internet Explorer\Main Enable Browser Extensions = "yes" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\Schedule AtTaskMaxHours = "48" Other Details This Trojan connects to the following possibly
\ Internet Explorer\Main Enable Browser Extensions = "yes" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\Schedule AtTaskMaxHours = "48" Other Details This Trojan connects to the following possibly
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{random key} Other System
\CurrentVersion\Explorer\ Browser Helper Objects\{8e1c1bef-14c5-419e-9ee5-00366c3c69eb} Other System Modifications This Trojan modifies the following files: %System Root%\ntldr (Note: %System Root% is the root
its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\explorer\ Browser Helper Objects\
its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\explorer\ Browser Helper Objects\
\ FirewallPolicy\DomainProfile\AuthorizedApplications\ List %WINDOWS%\\Explorer.EXE = %WINDOWS%\Explorer.EXE:*:Enabled:Windows Explorer Web Browser Home Page and Search Page Modification This Trojan modifies
\ Windows\CurrentVersion\Run G-Buster Browser Defense = %WINDOWS%\Noteped.exe Information Theft This spyware monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar
}r.com/statuses/user_timeline/118177052.rss with these actions It connects to the following URL(s) to send and receive commands from a remote malicious user: http://{BLOCKED}.{BLOCKED}.133.57/~duskrow/Twitter/ Web Browser Home Page and Search
Browser Home Page and Search Page Modification This Trojan lowers the security setting of Internet Explorer. Download Routine This Trojan connects to the following URL(s) to download its configuration file:
%Windows%\EXPLORER.EXE:*:Enabled:Windows Explorer Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. Information Theft This spyware attempts to