TSPY_ZBOT.MGQ

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is injected into all running processes to remain memory resident.

It modifies the Internet Explorer Zone Settings.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %User Profile%\Application Data\{random1}\{random}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It drops the following files:

• %User Profile%\Application Data\{random2}\{random}.{random}
• %User Profile%\Application Data\Microsoft\Address Book\winxp.wab
• %User Profile%\Application Data\Microsoft\Address Book\winxp.wab~
• %Application Data%\Identities\{CLSID}\Microsoft\Outlook Express\Folders.dbx
• %Application Data%\Identities\{CLSID}\Microsoft\Outlook Express\Inbox.dbx
• %Application Data%\Identities\{CLSID}\Microsoft\Outlook Express\Offline.dbx
• %Application Data%\Identities\{CLSID}\Microsoft\Outlook Express\Sent Items.dbx

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\Application Data\{random1}
• %User Profile%\Application Data\{random2}
• %User Profile%\Application Data\Microsoft\Address Book
• %Application Data%\Identities
• %Application Data%\Identities\{CLSID}
• %Application Data%\Identities\{CLSID}\Microsoft
• %Application Data%\Identities\{CLSID}\Microsoft\Outlook Express

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It is injected into all running processes to remain memory resident.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random CLSID} = "%User Profile%\Application Data\{random1}\{random}.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random}

HKEY_CURRENT_USER\Software\Microsoft\
WAB

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:Windows Explorer"

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Other Details

This spyware connects to the following possibly malicious URL:

• http://{BLOCKED}ivingchurch.org/chuma/config.bin