Home Malware Programs Trojans Trojan.Win32.LockScreen

Trojan.Win32.LockScreen

Posted: January 21, 2011

Trojan.Win32.LockScreen (or Win-Trojan/Zbot.163328.M) is a malicious trojan infection which comes armed with a web-redirector. Win-Trojan/Zbot.163328.M intercepts requests for up to 100 websites, including popular Russian websites and web-giants such as Yahoo and Youtube. Hackers specify the address to which the request is redirected. The site the browser redirectS to will most likely dowmload more malware onto the system. Remove Trojan.Win32.LockScreen using an updated malware remover.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\Wigouq\anyrg.tmp
    2 %AppData%\Wigouq\anyrg.unw
    3 %AppData%\Yniq\demuy.exe
    4 %Temp%\tmp54873343.bat

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]HKEY..\..\..\..{RegistryKeys}1406 =1609 =
Loading...