Need help? Ask the community or hire an expert.
Go to Avira Answers
Virus:TR/Spy.ZBot.aduw
Date discovered:18/01/2010
Type:Trojan
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Low to medium
Damage Potential:Low to medium
Static file:Yes
File size:172.032 Bytes
MD5 checksum:85d789babed70da3f79ab7c9979a2761
IVDF version:7.10.02.214 - Monday, January 18, 2010

 General Method of propagation:
    Autorun feature


Aliases:
   •  Panda: W32/Sinowal.WZV
   •  Eset: Win32/Spy.Zbot.UN
   •  Bitdefender: Trojan.Generic.CJ.AKAD


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads a malicious file
   • Drops malicious files
   • Registry modification

 Files It copies itself to the following locations:
   • %SYSDIR%\sdra64.exe
   • %drive%\%executed file%



The following files are created:

%drive%\Autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

%SYSDIR%\lowsec\user.ds
%SYSDIR%\lowsec\local.ds
%SYSDIR%\lowsec\user.ds.lll



It tries to download a file:

The location is the following:
   • http://kopuna.com/good/tlz/**********

 Registry It creates the following entry in order to bypass the Windows XP firewall:

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   • "EnableFirewall"=dword:0x00000000



The following registry keys are added:

[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-20]
   • "Migrate"=dword:0x00000002

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network]
   • "UID"="%computer name%_00076DDB"

[HKEY_USERS\S-1-5-20\Software\Microsoft\
   Protected Storage System Provider\S-1-5-20\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,1C,37,08,07,52,AF,80,9F,42,22,C5,C4,24,08,E7,F6,DC,C1,0B,F9,6F,04,6C,19,10,00,00,00,DB,BA,31,A6,A7,8B,50,80,63,5F,2B,88,9E,BC,52,64,14,00,00,00,CC,D8,BC,5A,5C,C5,B4,36,91,97,9E,48,43,A2,D3,C1,DF,3E,6A,F5

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="%computer name%_0007CF34"

[HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{35106240-D2F0-DB35-716E-127EB80A0299}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:47,09,F2,0D

[HKEY_USERS\.DEFAULT\Software\Microsoft\
   Protected Storage System Provider\S-1-5-18\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,81,19,B9,9D,0C,F8,BA,0A,1E,92,06,E1,97,47,46,6A,ED,17,AA,C4,3C,58,F3,78,10,00,00,00,E2,96,7F,78,01,CF,44,73,D0,B7,FA,36,F3,AB,D0,7B,14,00,00,00,DF,9D,82,E9,40,7A,0E,0A,5C,04,2F,05,4C,22,73,48,A3,CC,4A,A6

[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-19]
   • "Migrate"=dword:0x00000002

[HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:47,09,F2,0D

[HKEY_USERS\S-1-5-19\Software\Microsoft\
   Protected Storage System Provider\S-1-5-19\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,A1,8D,A9,46,76,AB,00,64,E5,2C,26,4C,D1,B2,D6,B3,BF,4E,C7,36,35,36,2E,BE,10,00,00,00,02,D4,18,F6,3D,29,A9,87,D4,3E,30,9D,8B,82,3C,81,14,00,00,00,BC,4C,8A,E7,91,28,24,BE,F4,9E,F6,F9,A9,4F,F8,9E,30,05,10,FC

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-18]
   • "Migrate"=dword:0x00000002

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="%computer name%_0007AA86"



The following registry keys are changed:

[HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main]
   New value:
   • "Start Page"=""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   New value:
   • "userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\sdra64.exe,"

[HKLM\SYSTEM\CurrentControlSet\Services\Cdrom]
   New value:
   • "AutoRun"=dword:0x00000001

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main]
   New value:
   • "Start Page"=""

 Injection It injects itself as a remote thread into a process.

    Process name:
   • winlogon.exe



It injects itself as a remote thread into processes.

    Process name:
   • svchost.exe



It injects itself as a remote thread into a process.

It is injected into all processes.


 File details Programming language:
The malware program was written in Visual Basic.

Description inserted by Petre Galan on Friday, June 11, 2010
Description updated by Petre Galan on Friday, June 11, 2010

Back . . . .