Sophos

Troj/Zlobol-Gen

Category
Type
What to do
Prevalence low high

Summary

 
Included in our products from September 2007 (4.21)
Protection available since 7 July 2006 08:10:50 (GMT)
Last updated 25 July 2007 23:31:14 (GMT)
Detected by All Sophos products

Action

More Information

Troj/Zlobol-Gen is a family of Trojans for the Windows platform.

Troj/Zlobol-Gen usually contain a dropper that drops an execute file to the Windows system folder, often called dxole32.exe or fxmngr.exe. It may also drop clean icon files to the same folder with names including ts.ico and ot.ico.

The dropped file usually creates URL shortcuts using the clean icons, creating them in locations including the Desktop and Start Menu.

Members of Troj/Zlobol-Gen may drop the clean data file \ncompat.tlb, and may also create files in the following locations:

\Microsoft\Crypto\rsa\
\Microsoft\Protect\

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer