Search
Keyword: unixliona1
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It modifies files, disabling programs and applications
Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060} ShowSearchSuggestions = "1" HKEY_CURRENT_USER\Software\Microsoft\ Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}
{ED54AAAA-2C30-4CE9-9FCF-17028AF006FD} MiscStatus\1 = "131473" HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ CLSID\{ED54AAAA-2C30-4CE9-9FCF-17028AF006FD} TypeLib = "{9340A3FF-7922-4B4F-A789-59495B157A70}" HKEY_LOCAL_MACHINE\SOFTWARE\Classes
HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ ShellFolder It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Internet Explorer\International\CpMRU Enable = "1
entries: HKEY_CURRENT_USER\Software\DownloadManager\ IDMBI\IEXPLORE name = "Internet Explorer" HKEY_CURRENT_USER\Software\DownloadManager\ IDMBI\IEXPLORE int = "1" HKEY_CURRENT_USER\Software\DownloadManager
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. However, as of this writing, the said sites are
\Policies\ Microsoft\Windows NT\SystemRestore It adds the following registry entries: HKEY_CURRENT_USER\Software\Policies\ Microsoft\Windows\System DisableCMD = "1" HKEY_CURRENT_USER\Software\Microsoft
entry is 1 .) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Policies\ System PromptOnSecureDesktop = 0 (Note: The default value data of the said registry entry is 1 .) HKEY_LOCAL_MACHINE
\Windows\WindowsUpdate DisableOSUpgrade = "1" HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ Microsoft\Windows\WindowsUpdate\ OSUpgrade ReservationsAllowed = "0" HKEY_LOCAL_MACHINE\SOFTWARE\qanz zojewbdazo = "{random
characters}" HKEY_CURRENT_USER\Software\qanz zojewbdazo = "{random characters}" HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ Microsoft\Windows\WindowsUpdate DisableOSUpgrade = "1" HKEY_LOCAL_MACHINE\SOFTWARE\Policies
entries: HKEY_CURRENT_USER\Software\WinRAR SFX C%%Program Files%WinRAR = "%Program Files%\WinRAR" HKEY_CURRENT_USER\Software\WinRAR\ Setup\.rar Set = "1" HKEY_CURRENT_USER\Software\WinRAR\ Setup\.zip Set =
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It connects to certain websites to send and receive
\WindowsUpdate DisableOSUpgrade = "1" HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ Microsoft\Windows\WindowsUpdate\ OSUpgrade ReservationsAllowed = "0" HKEY_LOCAL_MACHINE\SOFTWARE\qanz ltpxeirzlt = "JTkW2sRpWaZ6Tw==
CC58263A = "1" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion CC58263A = "2" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion CC58263A = "3" HKEY_CURRENT_USER\Software\Microsoft
LDAP Server ID = "1" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\VeriSign LDAP Server ID = "2" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\WhoWhere
\Microsoft\ Internet Account Manager\Accounts\Active Directory GC LDAP Server ID = "0" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP Server ID = "1" HKEY_CURRENT_USER
This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed
= "http://solvusoft.com/" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Uninstall\ WinThruster_is1 NoModify = "1" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion
\Microsoft\ RestartManager\Session0000 SessionHash = "{random characters}" HKEY_CURRENT_USER\Software\Microsoft\ RestartManager\Session0000 Sequence = "1" HKEY_CURRENT_USER\Software\Microsoft\ RestartManager
Sequence = "1" HKEY_CURRENT_USER\Software\Microsoft\ RestartManager\Session0000 RegFiles0000 = "\x00" HKEY_CURRENT_USER\Software\Microsoft\ RestartManager\Session0000 RegFilesHash = "{random characters}