Win32/Spy.Zbot.ZR
Posted: October 21, 2011
Threat Metric
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Threat Level: | 9/10 |
|---|---|
| Infected PCs: | 44 |
| First Seen: | October 21, 2011 |
|---|---|
| OS(es) Affected: | Windows |
Heads up vigilant computer users, as this particular threat's name depicts, a new variant of the Zbot Trojan has been spotted making rounds all across the Web.
Win32/Spy.Zbot.ZR is a newer, modified version of the Zbot Trojan – a malicious Trojan-based computer security threat that has been plaguing the cyber world for a while now – that is increasingly becoming known for its privacy invasive behavior. In other words, Win32/Spy.Zbot.ZR poses a definite data security risk, as well as seriously threatens any and all confidential, sensitive information stored on an infected computer system.
This means that this malicious, privacy invasive Trojan possesses a special proclivity for logging, storing, transmitting and stealing all types of confidential, personal and financial information off of the computer systems that Win32/Spy.Zbot.ZR successfully manages to infect. Such type of data at risk when dealing with a Win32/Spy.Zbot.ZR infection, are online bank account details, passwords, usernames, credit card information and other similar types of personal data.
Win32/Spy.Zbot.ZR's Direct Relationship to Malicious Email Attachments
Categorized as a backdoor Trojan, Win32/Spy.Zbot.ZR is reported to be spread and distributed, most often, via malicious spam emails containing infected attachments, but it has also been suggested that this Trojan may also be utilizing corrupt script on infected web domains and bundling various third-party file downloads with a seditious code that propagates Win32/Spy.Zbot.ZR.
The specific spam email messages and malicious attachments that have been directly linked to the malevolent Trojan distribution campaign, that works to propagate Win32/Spy.Zbot.ZR by spamming random computer users' inboxes with infected email attachments, are reported to bear the subject line: 'So now you're on LinkedIn: What's Next?'
According to SpywareRemove.com security analysts, this new spam-based Trojan propagation campaign is a follow up campaign to a similar one that was seen in September 2010. Additionally, it has been revealed that, though over a year has passed since the previous round of malicious LinkedIn spam messages were generated and sent out, the malware product being distributed has not changed at all.
The malicious emails that are being employed to endemically distribute Win32/Spy.Zbot.ZR are, reportedly, sent from the phony email address, 'LinkedIn .' What's more, these spam-type emails contained forged headers and LinkedIn branding that are meant to offer the corrupt emails a pretense of legitimacy.
If you have been a recipient of one of these malicious Trojan propagating spam messages, be sure NOT to clink on any links or open up any email attachments contained within the email messages. Reportedly, if you do click on one of the malicious links or attachments, Win32/Spy.Zbot.ZR is automatically and immediately downloaded onto your computer system, disguised as an Adobe Flash update.
Other Important Facets of the Win32/Spy.Zbot.ZR Trojan
Win32/Spy.Zbot.ZR has also been spotted functioning under several other aliases, a few of which are as follows:
– Trojan-Spy.Win32.Zbot.aptt [Kaspersky]
– Trojan.Zbot [PCTools]
– Trojan.Generic.KD.44402
Upon being successfully downloaded and installed onto a targeted computer system, Win32/Spy.Zbot.ZR will immediately begin working to make a variety of changes to the Windows registry located on infected computer systems, generate random system files, create new directories and processes, as well as an attempt to connect to a remote server, in order to transit any stolen data collected by this nasty backdoor Trojan.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:file.exe
File name: file.exeSize: 202.75 KB (202752 bytes)
MD5: 72fe63f68b0836930135d753125a267e
Detection count: 6
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 24, 2011
file.exe
File name: file.exeSize: 146.88 KB (146888 bytes)
MD5: 42dff9ad3d5072a7cbc2b6263839e4f8
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 24, 2011
file.exe
File name: file.exeSize: 101.61 KB (101616 bytes)
MD5: 9bf74da46caac9c01c4abe33abb1870f
Detection count: 4
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 24, 2011
file.exe
File name: file.exeSize: 197.12 KB (197120 bytes)
MD5: 8bc3d39a2b2b39e481cdfe65490d1fab
Detection count: 3
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 24, 2011
%SYSTEM%\wsnpoem.exe
File name: %SYSTEM%\wsnpoem.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
%SYSTEM%\drivers\wsnpoem.sys
File name: %SYSTEM%\drivers\wsnpoem.sysFile type: System file
Mime Type: unknown/sys
Group: Malware file
%SYSTEM%\ntos.exe
File name: %SYSTEM%\ntos.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
%SYSTEM%\twext.exe
File name: %SYSTEM%\twext.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
Chi45.sys
File name: Chi45.sysFile type: System file
Mime Type: unknown/sys
Group: Malware file
crypt_ldr.exe
File name: crypt_ldr.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
[random digits].exe
File name: [random digits].exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
dropped.exe
File name: dropped.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
eag1b.exe
File name: eag1b.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
bana.execog.exe
File name: bana.execog.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
Registry Modifications
HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon=%System%\userinit.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon=%System%\ntos.exe
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.