TSPY_ZBOT.WEL

This spyware may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It lowers the security setting of Internet Explorer.

Arrival Details

This spyware may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following component file(s):

• %Application Data%\Microsoft\Address Book\{current user}.wab
• %Application Data%\{random folder}\{random filename}.{random extension}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random folder}\{random filename}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random filename} = %Application Data%\{random folder}\{random filename}.exe

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
FirstRun = "1"

HKEY_CURRENT_USER\Software\Microsoft\
{random letters}
{random number} = {random data}

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%WINDOWS%\explorer.exe = "%WINDOWS%\explorer.exe:*:Enabled:Windows Explorer"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:Windows Explorer"

Web Browser Home Page and Search Page Modification

This spyware lowers the security setting of Internet Explorer.

Other Details

This spyware connects to the following possibly malicious URL:

• http://{BLOCKED}r.{BLOCKED}deal.com/web/config/index.php
• http://{BLOCKED}6.com/exe/install_flash_player.exe
• http://{BLOCKED}6.com/exe/ups_invoice_execsummary.doc