Need help? Ask the community or hire an expert.
Go to Avira Answers
??:TR/Spy.ZBot.bkaa
????:13/12/2012
??:?????
????:?
????????????????
??/????????
?? / ????????????
????:?
????:246.272 ??
MD5 ???:cbb8611337f0435726d4d504d1c9e3c3
VDF ??:7.11.53.216 - donderdag 13 december 2012
IVDF ??:7.11.53.216 - donderdag 13 december 2012

 ???? ??:
   •  Kaspersky: Trojan-Spy.Win32.Zbot.bkaa
   •  F-Secure: Trojan-Spy.Win32.Zbot.bkaa
   •  Bitdefender: Trojan.Generic.KD.192707
     GData: Trojan.Generic.KD.192707
     DrWeb: Trojan.PWS.SpySweep.42


??/????:
   • Windows 2000
   • Windows XP
   • Windows 2003


???:
   • ??????
   • ?????

 ?? ???????????:
   • C:\Recycle.Bin\Recycle.Bin.exe



???????????????



??????:

C:\Recycle.Bin\config.bin



??????????:

???:
   • C:\Recycle.Bin\Recycle.Bin.exe

 ??? ????????????????????????:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Recycle.Bin.exe"="C:\Recycle.Bin\Recycle.Bin.exe"



?????????????:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\1]
   • "1409"=dword:0x00000003

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\0]
   • "1409"=dword:0x00000003

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\2]
   • "1409"=dword:0x00000003

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
   • "GlobalUserOffline"=dword:0x00000000
   • "ProxyEnable"=dword:0x00000000
   • "ProxyHttp1.1"=dword:0x00000001
   • "WarnOnIntranet"=dword:0x00000000
   • "WarnOnPostRedirect"=dword:0x00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft Windows]
   • "000002C8EFC5BA55"=hex:5E,A3,78,C0,F7,F6,F6,F6,F6,F1,F2,F2,F2,F2,F0,F0,F0,F0,FD,FD,FD,FD,89,E6,C6,B2,D3,B1,DD,B8,B8,CA,AF,DF,EE,9E,9C,9C,80,AA,AA,AA,AA,C8,A7,D3,8C,EB,9E,F7,93,93,A6,88,B9,97,A5,93,A3,93,B2,E4,BC,91,A6,9E,A6,96,A1,91,D4,91,D2,93,A3,E0,C1,F2,CA,8F,BB,88,CA,F2,C1,A4,A2,B3,77,71,7B,0D,68,1A,69,00,6F,01,01,30,00,33,03,3A,5B,58,7A,26,2D,2D,3D,51,3E,5D,3C,50,0F,7B,12,7F,1A,1A,28,18,29,18,36,06,30,1E,2E,16,36,06,3E,04,34,01,3B,0A,32,1C,2B,1C,2C,49,4C,1D,59,5C,30,34,34,24,5E,31,5F,3A,3A,12,12,55,55,18,18,4C,4C,6C,6C,47,47,77,77,44,44,7E,7E,4E,4E,7E,7E,57,57,77,77,32,32,1C,88,88,8E,FB,FB,89,89,E6,E6,96,96,F3,BF,BB,BB,B3,E0,E0,94,94,F5,F5,9B,9B,FF,FF,9E,9E,EC,EC,88,88,A8,A8,FC,FC,95,95,F8,F8,9D,9D,FD,F6,9A,89,88,FC,95,F6,9D,39,29,2B,1A,2A,1D,2C,1A,B6,A5,A1,B2,B2,B2,B2,DD,AE,F1,1D,0B,EB,F6,9B,9D,8D,DD,CC,CC,CE,A2,C3,AD,CA,BF,DE,B9,DC,83,EA,8E,8E,BF,8F,BC,8F,8F,8F,8F,8F,9E,9E,9E

[HKCU\Software\Microsoft\Internet Explorer\Recovery]
   • "ClearBrowsingHistoryOnExit"=dword:0x00000000

[HKCU\Software\Microsoft\Internet Explorer\PhishingFilter]
   • "EnabledV8"=dword:0x00000000
   • "ShownServiceDownBalloon"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\3]
   • "1409"=dword:0x00000003

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\4]
   • "1409"=dword:0x00000003



?????????:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\1]
   ??:
   • "1406"=dword:0x00000000
   • "1609"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\0]
   ??:
   • "1406"=dword:0x00000000
   • "1609"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\2]
   ??:
   • "1406"=dword:0x00000000
   • "1609"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Lockdown_Zones\4]
   ??:
   • "1406"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Lockdown_Zones\1]
   ??:
   • "1406"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Lockdown_Zones\2]
   ??:
   • "1406"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Lockdown_Zones\3]
   ??:
   • "1406"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
   ??:
   • "EnableHttp1_1"=dword:0x00000001
   • "MigrateProxy"=dword:0x00000001
   • "WarnOnPost"=hex:00,00,00,00

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\3]
   ??:
   • "1406"=dword:0x00000000
   • "1609"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
   Zones\4]
   ??:
   • "1406"=dword:0x00000000
   • "1609"=dword:0x00000000

 ???? ?????:
??????:
   • mar**********.com:443 (TCP)
   • http://markizak.com/BViewbv32y77ebcbc/**********?guid=%???%&ver=%??%&ie=%???%&os=%???%&ut=%???%&ccrc=%???%&md5=%???%&plg=%???%&stat=%???%



???????????:
    • ?????
     ????
     ????????
     ???
     Windows ??????

 ???? ???????????????????

    ???:
   • explorer.exe



???????????????????

???????????


 ??  ??????????? Internet ??:
   • http://www.microsoft.com


Mutex:
?????? Mutex:
   • zrVfp8X63O165mU5UUiUU5u5KUUUuU

 ?????? ????:
????????? MS Visual C++ ????


???????:
???????????????????????????????

Beschrijving ingevoegd door Petre Galan op woensdag 8 juni 2011
Beschrijving bijgewerkt door Petre Galan op woensdag 8 juni 2011

Terug . . . .
https:// Dit venster is voor uw veiligheid gecodeerd.