"umber=62Confirmed=XFilename=Systrsy.exeDescription=Added by the CDTRAY TROJAN! Note - this malware actually changes the value data of the "(Default)" key in HKLM\Run in order to force Windows to launch it at boot.
"ry changes found by HijackThis, also creates the following system files: %WINDIR%\SYSTEM\ntldr.exe, C:\m.exe, C:\WINDOWS\Search-For-You.url, C:\n.bat, C:\q.exe, C:\r.batSource=Paul Collins Startup listNumber=10243Confirmed=NFilename=rundll32 RyDial.dll, QuickStartDescription=NTL Freedom dial-up ISP software - not requiredSource=Paul Collins Startup listNumber=10244Confirmed=XFilename=loadnewmessage.exeDescription=Added by the HIDAGENT-B WORM!Source=Paul Collins Startup listNumber=10245Confirmed=XFilename=ntmsevt.exeDescription=Added by the STOPED-B TROJANSource=Paul Collins Startup listNumber=10246Confirm" "ess.exeDescription=Added by the RBOT.AXZ WORM!Source=Paul Collins Startup listNumber=10240Confirmed=XFilename=ntfyapp.exeDescription=Detected by PCTools as the ZHELATIN WORM! See hereSource=Paul Collins Startup listNumber=10241Confirmed=YFilename=RPS.exeDescription=ntl Netguard - anti-virus a package of services, specifically designed to keep you safe and secure with their ntlworld online servicesSource=Paul Collins Startup listNumber=10242Confirmed=XFilename=ntldr.exeDescription=Browser hijacker to (). "href="" target="_blank">WinDefender 2008 rogue privacy program - not recommended, removal instructions hereSource=Paul Collins Startup listNumber=41Confirmed=XFilename=winnl.exeDescription=Added by the KIDKITI TROJAN!Source=Paul Collins Startup listNumber=42Confirmed=XFilename=winnm.exeDescription=Added by the KIDKITI TROJAN!Source=Paul Collins Startup listNumber=43Confirmed=XFilename=wuauqmr.exeDescription=Added by the " (Indicator: "windefend") References security related windows services YARA signature "keyboy_commands" classified file "" as "apt,keyboy" based on indicators: "Update,Refresh,OnLine,Disconnect,Download,FileManager" (Author: Matt Brooks, signature "HackTool_Producers" classified file "" as "hacktool" based on indicators: "source YARA Signature relevance 10/10 YARA signature "keyboy_commands" classified file "all.bstring" as "apt,keyboy" based on indicators: "Update,Refresh,OnLine,Disconnect,Download,FileManager" (Author: Matt Brooks, signature "HackTool_Producers" classified file "all.bstring" as "hacktool" based on indicators: "YARA signature "PROMETHIUM_NEODYMIUM_Malware_2" classified file "" as "apt,promethium,neodymium" based on indicators: "alg32.exe" (Reference:, Author: Florian Roth)
YARA signature "PROMETHIUM_NEODYMIUM_Malware_2" classified file "all.bstring" as "apt,promethium,neodymium" based on indicators: "alg32.exe" (Reference:, Author: Florian Roth)
0 kommentar(er)
