Keyword: ms04-11_microsoft_windows
101427 Total Search   |   Showing Results : 1 - 20
   Next  
\index.dat %Application Data%\Microsoft\Media Player\CURREN~1.WMD %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.XML %User Profile%
%Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.XML %User Profile%\History.IE5\index.dat %Temporary Internet Files%\Content.IE5
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It deletes itself after execution. Arrival Details This
following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run winite = "%User Profile%\Application Data\winite.exe
Modifications This worm modifies the following file(s): %Start Menu%\Programs\Accessories\Entertainment\Windows Media Player.lnk %Start Menu%\Programs\Windows Media Player.lnk %Application Data%\Microsoft\Windows
\Beta Windows Media Player.lnk %Windows% Media Player.lnk %Application Data%\Microsoft\Windows Media\9.0\WMSDKNSR.XML (Note: %Start Menu% is the current user's Start Menu folder, which is usually C:
Player.lnk %Start Menu%\Programs\Windows Media Player.lnk %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.XML %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD (Note: %Start Menu% is the
system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run HKLM = "%System%\Googlecom\%TEMP%.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run HKCU = "%System%
\DOCUME~1\Wilbert %User Profile%\LOCALS~1 %User Temp%\ %User Profile%\Microsoft\HTML Help (Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions..
\Windows Media Player.lnk %Start Menu%\Programs\Windows Media Player.lnk %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.XML %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD (Note: %Start
Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run wacult.exe = "
\Microsoft\HTML Help (Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %User Profile% is
{user name} on Windows 2000, XP, and Server 2003.) Other System Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ ActiveMovie\devenum\
\Microsoft\Windows Media %Application Data%\Microsoft\Windows Media\9.0 %User Profile%\Microsoft\Dr Watson (Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system
registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Windows Media Player = "%Program Files%\Windows Media Player
{user name} on Windows 2000, XP, and Server 2003.) Other System Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ ActiveMovie\devenum\
is usually C:\Windows\Temp or C:\WINNT\Temp.) It adds the following registry keys: HKEY_CURRENT_USER\Software\Microsoft\ ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B} HKEY_CURRENT_USER
Navigator\User Trusted External Applications %Program Files%\Windows Media Player\wmplayer.exe = "Yes" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Multimedia\WMPlayer\MIME Types\ audio/x-ms-wax UserApprovedOwning
registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced ShowSuperHidden = "0" HKEY_CURRENT_USER\Software\Microsoft\ ActiveMovie\devenum\
Profile%\CryptnetUrlCache\MetaData %User Profile%\Microsoft\CryptnetUrlCache %User Profile%\CryptnetUrlCache\Content (Note: %User Profile% is the current user's profile folder, which is usually C:\Documents