 |
|
 |
|
DizzyX
Administrator
Data inscrierii: 16/Iul/2008
Mesaje: 48
|
|
 |
|
 |
|
 Trimis: 16/07/2008 02:03 Titlul subiectului: Trojan.Spy.ZBot.EH |
 |
|
Trojan.Spy.ZBot.EH
( Trojan-Spy.Win32.Zbot.clg Tr/Spy.Zbot.clg )
Raspandire : mediu
Dauna : mediu
Size: ~50KB
Descoperit : 2008 Jun 14
SYMPTOMS:
- the presence of file: ntos.exe in %WINDIR%\system32\ folder or C:\Documents and settings\%username%\Application Data\.
- the presence of the following registry key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
userinit="%WINDIR%\system32\userinit.exe,%WINDIR%\system32\ntos.exe"
or
userinit="%WINDIR%\system32\userinit.exe,C:\Documents and settings\%username%\Application Data\ntos.exe"
TECHNICAL DESCRIPTION:
At execution this malware is a trojan that copies itself in %WINDIR%\system32\ntos.exe (or C:\Documents and settings\%username%\Application Data\) and he will realizate a registry key in order to make sure it will be executed after every reboot.
He will inject in svchost.exe and winlogon.exe and he can provide backdoor and proxy server capabilities. |
|
FAQ 
Mesaje private 
