Home Malware Programs Trojans Backdoor.Win32.Gbot.gzn

Backdoor.Win32.Gbot.gzn

Posted: June 22, 2011

Backdoor.Win32.Gbot.gzn is a backdoor Trojan that attempts to alter your Internet settings, contact remote servers, open ports without your permission, and run automatically whenever Windows starts. A Backdoor.Win32.Gbot.gzn infection is a deadly computer security threat, in spite of the fact that Backdoor.Win32.Gbot.gzn was first seen long ago in 2008. You should stomp out any risks posed by Backdoor.Win32.Gbot.gzn, by using a trusted and fully-updated security program to remove Backdoor.Win32.Gbot.gzn.

How Backdoor.Win32.Gbot.gzn Gets Past Your Watchful Eyes

Like most backdoor Trojans, Backdoor.Win32.Gbot.gzn tries to hide itself so that Backdoor.Win32.Gbot.gzn can't be seen before your security's been compromised. Backdoor.Win32.Gbot.gzn does this by secluding Backdoor.Win32.Gbot.gzn's files in your Temp and Applicaiton Data folders, as well as by naming them seemingly harmless names like 'conhost.exe.' The Windows Registry is changed to let Backdoor.Win32.Gbot.gzn run automatically, amongst other things.

Backdoor.Win32.Gbot.gzn is also related to Backdoor.Win32.Gbot.A and Backdoor.Win32.Gbot.B, which are similar backdoor Trojans that may accompany or replace Backdoor.Win32.Gbot.gzn in an attack on your PC. The majority of backdoor Trojans abuse Flash and JavaScript exploits to install themselves through your browser, although you may also become infected by Backdoor.Win32.Gbot.gzn after downloading a compromised file.

The Other Registry-Based Problems That Backdoor.Win32.Gbot.gzn Has for Your PC

Although Backdoor.Win32.Gbot.gzn's ability to launch itself automatically is central to Backdoor.Win32.Gbot.gzn's functions, Backdoor.Win32.Gbot.gzn may also make many other Windows Registry changes. Backdoor.Win32.Gbot.gzn may delete Registry entries to harm your computer, or change your Internet and other system settings to lower your security.

All of these Registry changes also help Backdoor.Win32.Gbot.gzn make unauthorized contact with outside parties. One possible sign of a Backdoor.Win32.Gbot.gzn infection is evidence of port 50724 being open, a vulnerability that can be exploited by remote attackers. Backdoor.Win32.Gbot.gzn's actions are indicative of potential remote attacks that can control your computer, steal information, or install other malicious software. As such, any Backdoor.Win32.Gbot.gzn infection is an extreme security risk that should be eliminated with haste.

Besides being an initial attack that softens up your security for later abuse, Backdoor.Win32.Gbot.gzn's actions can also take up significant system resources. If you notice a general slowdown of your PC or unusual network traffic, you may want to check for a Backdoor.Win32.Gbot.gzn Trojan on your computer.

Despite running multiple processes, Backdoor.Win32.Gbot.gzn may not be visible and shouldn't be deleted with manual methods if better options are available. Running a high-quality security program in Safe Mode should detect and remove Backdoor.Win32.Gbot.gzn components and related threats. However, you may need to revert Backdoor.Win32.Gbot.gzn's changes to your Internet and security settings.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\dwm.exe
    2 %AppData%\E11E.576
    3 %AppData%\Microsoft\conhost.exe
    4 %Temp%\5.tmp
    5 %Temp%\6.tmp
    6 %Temp%\csrss.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\C0AB6693AB3202B4B9D95716ED5CE4A6\SourceList LastUsedSource = "n;1;%ProgramFiles%\Common Files\Wise Installation Wizard\"HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Shell = "explorer.exe,%AppData%\dwm.exe"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings ProxyServer = "http=127.0.0.1:56323"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost = "%AppData%\Microsoft\conhost.exe"
Loading...