Du brauchst Hilfe? Frage die Community oder wende dich an einen Experten.
Zu Avira Answers
Virus:TR/Spy.ZBot.pcd
Date discovered:15/07/2010
Type:Trojan
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Low
Damage Potential:Low to medium
Static file:Yes
File size:118.272 Bytes
MD5 checksum:34785719f9f106ea4183e081a1497cb7
IVDF version:7.10.09.92 - Thursday, July 15, 2010

 General Aliases:
   •  Bitdefender: Trojan.Generic.KD.20255
   •  Panda: Trj/Sinowal.XFF
   •  Eset: Win32/Spy.Zbot.YW


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads a malicious file
   • Drops malicious files
   • Registry modification
   • Makes use of software vulnerability
        CVE-2007-1204
        MS07-019

 Files It copies itself to the following location:
   • %SYSDIR%\sdra64.exe



The following files are created:

%SYSDIR%\lowsec\user.ds
%SYSDIR%\lowsec\local.ds
%SYSDIR%\lowsec\user.ds.lll



It tries to download a file:

The location is the following:
   • http://113.11.194.175/uk/**********

 Registry It creates the following entry in order to bypass the Windows XP firewall:

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   • "EnableFirewall"=dword:0x00000000



The following registry keys are added:

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="%computer name%_7875768FCFF3ECE1"

[HKEY_USERS\.DEFAULT\Software\Microsoft\
   Protected Storage System Provider\S-1-5-18\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,57,6F,9D,AF,7D,E6,36,AA,6A,68,3F,AE,02,8D,CA,CC,DD,E1,53,47,27,16,AD,AE,10,00,00,00,89,3D,50,AD,A5,CF,68,A8,24,AE,9C,50,4F,CE,FB,3C,14,00,00,00,0E,7A,2E,62,67,02,4C,87,2F,B9,82,BD,14,A7,14,EA,6E,C9,BA,57

[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-19]
   • "Migrate"=dword:0x00000002

[HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:F7,09,F2,0D

[HKEY_USERS\S-1-5-19\Software\Microsoft\
   Protected Storage System Provider\S-1-5-19\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,AF,F8,93,D1,AB,2B,B1,F0,C3,9D,47,15,85,46,2E,DE,73,10,CA,79,90,78,B0,27,10,00,00,00,CD,A2,D0,3B,A8,18,52,9F,86,1D,33,31,B4,4E,20,F1,14,00,00,00,CE,58,EE,A8,EA,9F,7A,D0,0E,29,75,B9,82,16,9B,9B,BF,54,67,5C

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-18]
   • "Migrate"=dword:0x00000002

[HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{3446AF26-B8D7-199B-4CFC-6FD764CA5C9F}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:F7,09,F2,0D

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network]
   • "UID"="%computer name%_7875768FCFF3ECE1"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="%computer name%_7875768FCFF3ECE1"



The following registry keys are changed:

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   New value:
   • "userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\sdra64.exe,"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

 Injection It injects itself as a remote thread into a process.

    Process name:
   • winlogon.exe



It injects itself as a remote thread into a process.

    Process name:
   • svchost.exe



It injects itself as a remote thread into a process.

It is injected into all processes.


 Miscellaneous Mutex:
It creates the following Mutexes:
   • _AVIRA_2110
   • _AVIRA_2109
   • _AVIRA_2108
   • _AVIRA_2101
   • _AVIRA_21099

 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Die Beschreibung wurde erstellt von Petre Galan am Freitag, 12. November 2010
Die Beschreibung wurde geändert von Petre Galan am Freitag, 12. November 2010

zurück . . . .