Home Malware Programs Trojans Trojan-Spy.Win32.Zbot.aqzk

Trojan-Spy.Win32.Zbot.aqzk

Posted: February 24, 2011

Trojan-Spy.Win32.Zbot.aqzk is a Trojan keylogger that can record your keyboard input and transmit this information to remote criminals. Trojan-Spy.Win32.Zbot.aqzk may also be involved in the rogue malware industry and may drop rogue programs onto your system. Through the use of startup registry entries, Trojan-Spy.Win32.Zbot.aqzk can run whenever your system loads without overt indications of its presence. Any computer infected by this Trojan is by definition highly insecure; deleting Trojan-Spy.Win32.Zbot.aqzk isn't optional if you hold your computer's safety near to your heart.

A Spy and Possibly More

Trojan-Spy.Win32.Zbot.aqzk has been confirmed to create a startup registry entry. This lets Trojan-Spy.Win32.Zbot.aqzk run without the consent or knowledge of the infected system's user, a process which can't be blocked without resorting to highly secure methods such as Safe Mode.

Given its official status as a Trojan, Trojan-Spy.Win32.Zbot.aqzk is very likely to drop other malware on your computer and has been reported to have trafficking with rogue products and browser hijackers. Rogue infections will attempt to imitate anti-malware scanners or other system tools, but will actually create problems and issue fake reports on system errors.

The most immediate danger Trojan-Spy.Win32.Zbot.aqzk threatens systems with is spyware activity. Through keylogger capabilities, Trojan-Spy.Win32.Zbot.aqzk is able to record every individual keystroke made through your keyboard, including account passwords and other confidential tidbits. This information is then handed over to the remote criminals in charge of Trojan-Spy.Win32.Zbot.aqzk, allowing them to commit identity theft or other crimes.

Why Trojan-Spy.Win32.Zbot.aqzk Turns Your Computer's Defenses into Junk

Just having Trojan-Spy.Win32.Zbot.aqzk around will make your system vulnerable, since the infection lowers security settings to perform its basic functions. Some probably security-related attacks include but aren't restricted to:

  • A lowered firewall.
  • Opened ports, particularly ports 80 and 81.
  • Altered browser settings. Proxy servers may be used to hijack your browser, and settings that protect against unauthorized file downloads may be altered. Your homepage may also be changed to a malicious site.
  • The blocking of websites related to security or system maintenance. The Trojan does this to prevent you from downloading tools or finding information that could be used to delete Trojan-Spy.Win32.Zbot.aqzk.
  • Blocked programs. This is standard malicious self-defensive behavior by malware like Trojan-Spy.Win32.Zbot.aqzk that forcibly closes anti-malware programs before they can delete the threat. It Trojan-Spy.Win32.Zbot.aqzk may extend to programs essential to Windows such as the Task Manager.

Trojan-Spy.Win32.Zbot.aqzk may not offer alarming evidence of its activities, but that doesn't make its attacks any less dangerous. Don't neglect to remove Trojan-Spy.Win32.Zbot.aqzk if you have any suspicions of Trojan-Spy.Win32.Zbot.aqzk being on your system; the correct response in a timely manner may save your computer, your identity or your bank account.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %PROGRAM_FILES%\Trojan-Spy.Win32.Zbot.aqzk.
    2 c:\Documents and Settings\All Users\Start Menu\Trojan-Spy.Win32.Zbot.aqzk\
    3 c:\Documents and Settings\All Users\Trojan-Spy.Win32.Zbot.aqzk\

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\Software\Trojan-Spy.Win32.Zbot.aqzk
Loading...