Troj/Zbot-EC is a Trojan for the Windows platform.
When run, Troj/Zbot-EC copies itself into the Windows system folder as sdra64.exe.
<Windows>\System32\sdra64.exe
The following Registry entry is set to run the Trojan at startup.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<Windows>\system32\userinit.exe,<Windows>\system32\sdra64.exe