Troj/Bifrose-ZB is a Trojan for the Windows platform.
When first run, Troj/Bifrose-ZB copies itself to the following location:
<System>\regscr32.exe
The following registry entries are created to start Troj/Bifrose-ZB automatically when Windows starts:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Server Registry
<System>\regscr32.exe
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Server Registry
<System>\regscr32.exe
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}
stubpath
<System>\regscr32.exe s
Troj/Bifrose-ZB attempts to connect to external websites, and may cause Internet Explorer to crash. If BOPS is enabled, Buffer Overflow warnings will be triggered.
Members of the Bifrose family typically create a backdoor on an infected computer, allowing an attacker to connect to the computer from the Internet.
Troj/Bifrose-ZB has been seen sent out within an RTF document file (eg support-form.doc) in a spam campaign with subject lines similar to the following:
Subject: Nonrefundable loan approved for your company!
These emails claim to be part of an Australian government program for business development.