https://aznot.com/index.php?action=history&feed=atom&title=WinddowsUpdater_Worm 2026-05-07T19:25:34Z Revision history for this page on the wiki MediaWiki 1.41.0 https://aznot.com/index.php?title=WinddowsUpdater_Worm&diff=5352&oldid=prev 2020-02-25T23:52:31Z

<p><span dir="auto"><span class="autocomment">keywords</span></span></p> <p><b>New page</b></p><div>== WinddowsUpdater Worm ==<br /> <br /> &lt;pre&gt;<br /> Windows Registry Editor Version 5.00<br /> <br /> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]<br /> &quot;WinddowsUpdater&quot;=&quot;C:\\WinddowsUpdater\\WinddowsUpdater.exe \&quot;C:\\WinddowsUpdater\\WinddowsUpdater.zip\&quot;&quot;<br /> &quot;WinddowsUpdate&quot;=&quot;C:\\WINDOWS\\system32\\cmd.exe /c start C:\\WinddowsUpdater\\WinddowsUpdater.exe \&quot;C:\\WinddowsUpdater\\WinddowsUpdater.zip\&quot; &amp; exit&quot;<br /> &lt;/pre&gt;<br /> <br /> In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run<br /> WinddowsUpdater = &quot;C:\WinddowsUpdater\WinddowsUpdater.exe C:\WinddowsUpdater\WinddowsUpdater.zip&quot;<br /> In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run<br /> WinddowsUpdate = &quot;C:\WinddowsUpdater\WinddowsUpdater.exe C:\WinddowsUpdater\WinddowsUpdater.zip&quot;<br /> In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run<br /> WinddowsUpdater = &quot;C:\WinddowsUpdater\WinddowsUpdater.exe C:\WinddowsUpdater\WinddowsUpdater.zip&quot;<br /> In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run<br /> WinddowsUpdate = &quot;C:\WinddowsUpdater\WinddowsUpdater.exe C:\WinddowsUpdater\WinddowsUpdater.zip&quot;<br /> <br /> run:<br /> shell:common startup<br /> <br /> C:\WinddowsUpdater\WinddowsUpdater.exe &quot;C:\WinddowsUpdater\WinddowsUpdater.zip&quot;<br /> C:\WINDOWS\system32\cmd.exe /c start C:\WinddowsUpdater\WinddowsUpdater.exe &quot;C:\WinddowsUpdater\WinddowsUpdater.zip&quot; &amp; exit<br /> <br /> run: (won&#039;t show up in explorer)<br /> C:\WinddowsUpdater<br /> C:\WinddowsUpdateCheck<br /> <br /> Ref: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/WORM_RETADUP.A<br /> <br /> Ref: https://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/<br /> <br /> == keywords ==<br /> <br /> winddow winddows winddowsupdater winddowsupdate</div>

Kenneth