TR/Zlob.CI - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Zlob.CI
Date discovered:	14/09/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	29.696 Bytes
MD5 checksum:	d7950Ad9203623cd045cb9cd0Fbb9f48
VDF version:	6.36.00.09
IVDF version:	6.36.00.19 - Sat, 16 Sep 2006 22:12 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Kaspersky: Trojan-Downloader.Win32.Zlob.akz
   • F-Secure: Trojan-Downloader.Win32.Zlob.akz
   • Bitdefender: Trojan.Downloader.Zlob.AKU

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Registry modification

Files The following files are created:

– %malware execution directory%\isaddon.dll Further investigation pointed out that this file is malware, too.
– %malware execution directory%\isamini.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: TR/Zlob.CI

Registry It registers a browser helper object (BHO) by adding the following key:

The registered DLL file changes the startpage of Internet Explorer to: http://www.theuptodatesafety.com/
– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
   Browser Helper Objects\{202a961f-23ae-42b1-9505-ffe3c818d717}
   • "(default)"=""

The following registry keys are added:

– HKLM\SOFTWARE\Classes\CLSID\{202a961f-23ae-42b1-9505-ffe3c818d717}
   • "(default)"=""

– HKLM\SOFTWARE\Classes\CLSID\{202a961f-23ae-42b1-9505-ffe3c818d717}\
   InprocServer32
   • "(default)"="%malware execution directory%\isaddon.dll"
   • "ThreadingModel"="Apartment"

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
   run
   New value:
   • "homepage.monitor.exe"="%malware execution directory%\%executed file%"

See a brief description here.

Description inserted by Teodor Onisor on Mon, 23 Oct 2006 08:57 (GMT+1)
Description updated by Teodor Onisor on Tue, 24 Oct 2006 09:38 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back