Home Malware Programs Trojans Trojan-Spy.Win32.Zbot.amwf

Trojan-Spy.Win32.Zbot.amwf

Posted: May 10, 2011

Trojan-Spy.Win32.Zbot.amwf is a high severity computer trojan that can record detailed information, such as user's accounts information, passwords, credit cards numbers, websites that a users visits, take screenshot of user's activity and record online chatting. Trojan-Spy.Win32.Zbot.amwf can even make changes to processes and system files and block legitimate security applications from receiving updates. Trojan-Spy.Win32.Zbot.amwf also harms the data and files on the computer which in turn will lead to the improper running of the computer or failure to access the PC system. Remove Trojan-Spy.Win32.Zbot.amwf from your machine as soon as possible so as to keep your computer protected.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\Seal\pary.tmp %AppData%\Seal\pary.yko %AppData%\Xiob\yniqb.exe %Temp%\tmp72062884.bat

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PrivacyHKEY_CURRENT_USER\Software\Microsoft\Lepuyg[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy] CleanCookies = 0×00000000[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 1406 = 1609 =[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]HKEY..\..\..\..{RegistryKeys}{319F52F5-5AA0-9518-9341-AC8A32B7210C} = ""%AppData%\Xiob\yniqb.exe""
Loading...