Home Malware Programs Rogue Anti-Spyware Programs Vz.exe

Vz.exe

Posted: November 24, 2010

Vz.exe is a system name for rogue antispyware that pretends to be a Windows update installed automatically. Once the parasite is installed, it determines if it needs to drop adware under the Vista, Win 7 or XP name. Vz.exe will detect the type of infected system and sends a relevant request for malicious adware to a remote server. The server migrates from one IP to another attempting to avoid being blocked by browsers and firewalls. Therefore a Vista system should receive malware under the Vista name like Vista Antimalware 2011. Remove Vz.exe before it starts wreaking havoc on your system.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\vz.exe
    2 %AppData%\{RANDOM}

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Classes\.exeHKEY_CURRENT_USER\Software\Classes\.exe | @ = "pezfile"HKEY_CURRENT_USER\Software\Classes\.exe | Content Type = "application/x-msdownload"HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIconHKEY_CURRENT_USER\Software\Classes\.exe\shellHKEY_CURRENT_USER\Software\Classes\.exe\shell\openHKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | @ = ""%AppData%\vz.exe" /START "%1" %*"HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | IsolatedCommand = ""%1" %*"HKEY_CURRENT_USER\Software\Classes\.exe\shell\runasHKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\commandHKEY_CURRENT_USER\Software\Classes\.exe\shell\startHKEY_CURRENT_USER\Software\Classes\.exe\shell\start\commandHKEY_CURRENT_USER\Software\Classes\pezfileHKEY_CURRENT_USER\Software\Classes\pezfile\DefaultIconHKEY_CURRENT_USER\Software\Classes\pezfile\shellHKEY_CURRENT_USER\Software\Classes\pezfile\shell\openHKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\commandHKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command | @ = ""%AppData%\vz.exe" /START "%1" %*"HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command | IsolatedCommand = ""%1″ %"HKEY_CURRENT_USER\Software\Classes\pezfile\shell\runasHKEY_CURRENT_USER\Software\Classes\pezfile\shell\runas\commandHKEY_CURRENT_USER\Software\Classes\pezfile\shell\startHKEY_CURRENT_USER\Software\Classes\pezfile\shell\start\command[HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command][HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command]HKEY..\..\..\..{RegistryKeys}"Content Type"="application/x-msdownload"@="exefile"[HKEY_CLASSES_ROOT\.exe\shell\open\command][HKEY_CLASSES_ROOT\.exe][HKEY_CLASSES_ROOT\secfile]
Loading...