Sophos

Troj/Spabot-D

Aliases
  • Trojan.Win32.Spabot.i
  • Trojan.SpBot
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Protection available since 6 April 2005 13:57:32 (GMT)
Detected by All Sophos products
Sophos beta program Sophos beta program
Register now for our latest beta tests
  • Endpoint Security and Control 9.0
  • Small business solutions 4.0

Action

More Information

Troj/Spabot-D is a Trojan for the Windows platform.

When run the Trojan attempts to send spam emails to random email addresses while running in the background as a process.

The Trojan copies itself to Windows System folder.

Troj/Spabot-D contacts a remote URL to download configuration data and to report that the computer is infected. The Trojan attempts to download the following configuration files to the Windows Temporary folder:

url.sys
tsk.sys
body.dat
mailz.dat

Troj/Spabot-D also attempts to download to %TEMP%\FILE.EXE from a remote website and run it.

The Trojan may disable Security Center feature in Windows XP Service Pack 2 by setting the following registry entries:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update
AUOptions
1

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4

Troj/Spabot-D may also create the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler\(0211C4D9-BC71-8916-38AD-9DEA5D213614)
OLE Module

HKLM\Software\Microsoft\Windows\CurrentVersion\
ShellServiceObjectDelayLoad\OLE Module
(0211C4D9-BC71-8916-38AD-9DEA5D213614)

HKCU\Software\Classes\CLSID\(0211C4D9-BC71-8916-38AD-9DEA5D213614)\
InProcServer32\@
%SYSTEM%\smp.dll

HKCU\Software\Classes\CLSID\(0211C4D9-BC71-8916-38AD-9DEA5D213614)\
InProcServer32\ThreadingModel
Apartment

The Trojan may create branches below the following registry entry:

HKCU\Software\Microsoft\Internet Explorer\Security\

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer