Search
Keyword: browser hijacker
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{2FF811E6-8925-4084-A649-C159955E67E8}
registry keys: HKEY_CURRENT_USER\Software\Microsoft\ {random key name} It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Internet Explorer\Privacy CleanCookies = "0" Web Browser
Information Username Computername OS Version Hardware Information Running Processes However, as of this writing, the said sites are inaccessible. Web Browser Home Page and Search Page Modification This backdoor
}.exe" Other System Modifications This spyware adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ {random key} Web Browser Home Page and Search Page Modification This spyware modifies
\AuthorizedApplications\ List %Windows%\explorer.exe = %Windows%\explorer.exe:*:Enabled:Windows Explorer Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings.
its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\
\CurrentVersion\explorer\ Browser Helper Objects\{7B434A2A-9E4C-48F2-8373-5801F316A4D5} Other System Modifications This Trojan deletes the following files: %System Root%\DelTemp.bat (Note: %System Root% is the root
its automatic execution every time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\explorer\ Browser Helper Objects\
HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\explorer\ Browser Helper Objects\{A271818F-0DF1-417A-9D53-F37E0728AFDF} Other System Modifications This Trojan adds the following registry keys:
installation routine: HKEY_CURRENT_USER\Software\Microsoft\ Internet Explorer\Main Use FormSuggest = Yes Web Browser Home Page and Search Page Modification This Trojan modifies Internet Explorer zone settings.
" Other System Modifications This spyware adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ {random} Web Browser Home Page and Search Page Modification This spyware modifies the
{random} Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. Other Details This spyware connects to the following possibly malicious URL: http://
{random}.exe" Other System Modifications This spyware adds the following registry keys as part of its installation routine: HKEY_CURRENT_USER\Software\Microsoft\ {random} Web Browser Home Page and Search
by other malware. It is also installed as a Browser Helper Object (BHO). Installation This Trojan drops the following files: %User Temp%\msfat32 %User Temp%\msmonitor %User Temp%\{random file name}.tmp
{random} Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. Other Details This spyware connects to the following possibly malicious URL: http://
{random} Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. Other Details This spyware connects to the following possibly malicious URL: http://
{random} Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. Other Details This spyware connects to the following possibly malicious URL: http://
routine. NOTES: This spyware is usually dropped as %System\ws2help.dll. A legitimate ws2help.dll exists in the said folder, thus it is replaced by this spyware. It monitors the Internet Browser of an
\Software\Microsoft\ Windows\CurrentVersion\Internet Settings GlobalUserOffline = "0" Web Browser Home Page and Search Page Modification This spyware modifies Internet Explorer zone settings. Other Details
by other malware. It is also installed as a Browser Helper Object (BHO). Installation This Trojan drops the following files: %User Temp%\msfat32 %User Temp%\msmonitor %User Temp%\{random file name}.tmp