Search
Keyword: browser hijacker
a specific URL and execute it Web Browser Home Page and Search Page Modification This Worm modifies the Internet Explorer Zone Settings. Other Details This Worm connects to the following website to
unknowingly by users when visiting malicious sites. It may be manually installed by a user. Web Browser Home Page and Search Page Modification This potentially unwanted application modifies the Internet
Windows Server 2012.) It adds the following processes: cmd.exe /c del {malware path}\{malware name} >> NUL It executes then deletes itself afterward. Web Browser Home Page and Search Page Modification This
\ Windows\CurrentVersion\Internet Settings GlobalUserOffline = "0" Web Browser Home Page and Search Page Modification This Trojan modifies the Internet Explorer Zone Settings. Other Details This Trojan
{random values}" Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. Other Details This spyware requires the existence of the following files to
time Internet Explorer is used by adding the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1}
Print Commands (OPENURL) - Opens a URL using a hidden browser (POST) - Sends POST floods (QUIT) - Terminate itself (SHELL EXEC) - Executes shell command (SPEEDTEST) - check connection speed
}.exe" Other System Modifications This spyware adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ {random key} Web Browser Home Page and Search Page Modification This spyware modifies
(DOWNLOAD) - Downloads and execute arbitrary file (EXEC) - Executes command (GET) - Sends GET floods (HELP) - Print Commands (OPENURL) - Opens a URL using a hidden browser (POST) - Sends POST floods (QUIT) -
itself in all removable drives: {Drive Letter}:\{Random File Name}.JPG.jse Web Browser Home Page and Search Page Modification This Worm modifies the user's Internet Explorer home page to the following
Program Files Program Files (x86) ProgramData Programmer Recovery System Volume Information Windows 39ce3cc9a4c9635fb5a3 a0d8335d1416763a86 Tor Browser It appends the following extension to the file name of
\SOFTWARE\Microsoft\ Internet Explorer\Main Enable Browser Extensions = "yes" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\Schedule AtTaskMaxHours = "48" Other Details This Trojan connects to the
\Software\FpLd6GBoSJ NewId = "Server" HKEY_CURRENT_USER\Software\FpLd6GBoSJ ServerStarted = "{Date and Time}" Web Browser Home Page and Search Page Modification This Trojan modifies the Internet Explorer Zone
registry entries: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ Services\MD ServicesB1 Description = "Thank you" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ Services\FireFox Description = "FireFox Browser Driver
following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\ Browser Helper Objects\{61BD6924-D4FB-4BA2-B2EF-EBE5E203D122} Other System Modifications This Trojan adds the
Client Hash = "{Random Hex Values}" HKEY_CURRENT_USER\Software\WinRAR HWID = "{Random Hex Values}" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\Tcpip\Parameters MaxUserPort = "65534" Web Browser
is "1" .) Web Browser Home Page and Search Page Modification This Trojan modifies the Internet Explorer Zone Settings. Other Details This Trojan connects to the following possibly malicious URL:
information to its command and control (C&C) server: Processor information OS version information Current usage of both physical and virtual memory Install language information Username Web Browser Home Page
}.exe" Other System Modifications This spyware adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ {random key} Web Browser Home Page and Search Page Modification This spyware modifies
HKEY_CURRENT_USER\Software\Microsoft\ {random key} Web Browser Home Page and Search Page Modification This spyware modifies the Internet Explorer Zone Settings. Other Details This spyware connects to the following