high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 11 April 2008 22:48:09 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
When Troj/Zlob-AKA is installed the following files are created:
<Program Files>\NetProject\sbmdl.dll - detected as Troj/Zlob-AKA
<Program Files>\NetProject\sbmntr.exe - detected as Troj/Zlob-AKA
<Program Files>\NetProject\sbsm.exe - detected as Troj/Zlob-AKA
<Program Files>\NetProject\sbun.exe - detected as Troj/Zlob-AKA
The following registry entry is created to run sbmntr.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
start
<Program Files>\NetProject\sbmntr.exe
The file sbmdl.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}
HKCR\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}
Troj/Zlob-AKA changes search settings for Microsoft Internet Explorer by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Search\
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}
MenuText
IE Anti-Spyware
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}
Exec
http://www.<URLNotDisplayed>.com/redirect.php
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}
CLSID
{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Secure Browsing
HKCU\Software\NetProject
Troj/Zlob-AKA provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "Secure Browsing".
|
