TSPY_ZBOT.TE

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies the Internet Explorer Zone Settings.

It deletes itself after execution.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops a copy of itself in the following folders using different file names:

• %User Profile%\Application Data\{Random Folder 1}\{Random Filename}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following file(s)/component(s):

• %User Profile%\Application Data\{Random Folder 2}\{Random Filename and Extension}
• %User Profile%\Application Data\{Random Folder 3}\{Random Filename and Extension}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It injects itself into the following processes running in the affected system's memory:

• explorer.exe
• cmd.exe

It creates the following folders:

• %User Profile%\Application Data\{random folder 1}
• %User Profile%\Application Data\{random folder 2}
• %User Profile%\Application Data\{random folder 3}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random Characters} = %User Profile%\Application Data\{Random Folder 1}\{Random Filename}.exe

File Infection

This spyware avoids infecting folders containing the following strings:

• Anti-Virus
• AntiVir
• Antivirus
• Client
• Desktop
• Kaspersky
• Malware
• McAfee
• Microsoft
• Monitor
• Norton
• Protection
• Security
• SecurityCenter
• Service
• Shared
• Symantec
• avast!

Backdoor Routine

This spyware connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}da09.org

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Information Theft

This spyware accesses the following site to download its configuration file:

• http://{BLOCKED}de.in/g.php

Other Details

This spyware deletes itself after execution.