| Property | Value |
|---|
| rdf:type | |
| rdfs:label | |
| rdfs:comment | - Zlob is a trojan horse which masquerades as a needed video codec in the form of ActiveX. Zlob allows a remote attacker to perform various malicious actions on the compromised computer. It was first detected in late 2005. However, it wasn't until mid-2006 that it started gaining attention. Once installed, it displays popup ads with appearance similar to real Microsoft Windows warning popups, informing the user that their computer is infected with spyware. Clicking these popups trigger the download of a fake anti-spyware program (such as Virus Heat) in which the trojan horse is hidden.
- Zlob or the Zlob Trojan is a trojan that can infect your computer by pretending to be a fake video codec in the form of Active X but can also infect the host's computer by rogue software.It was first detected in late 2005, but only started gaining attention in mid-2006. Once installed, it displays popup ads with appearance similar to real Microsoft Windows warning popups, informing the user that their computer is infected with spyware. Clicking these popups triggers the download of a fake anti-spyware program (such as Virus Heat and MS Antivirus ((Antivirus 2009)) in which the trojan is hidden.
|
| dcterms:subject | |
| dbkwik:malware/property/wikiPageUsesTemplate | |
| dbkwik:computersecurity/property/wikiPageUsesTemplate | |
| Date | |
| Origin | |
| Platform | |
| Type | |
| Aliases | - * TrojanDownloader.Win32.Zlob.a
* Trojan.Zlob
* Downloader.Zlob.A
* NewHeur_PE
* Zlob.VideoActiveXObject
|
| AKA | |
| Creator | |
| Size | |
| affectedplatforms | |
| abstract | - Zlob or the Zlob Trojan is a trojan that can infect your computer by pretending to be a fake video codec in the form of Active X but can also infect the host's computer by rogue software.It was first detected in late 2005, but only started gaining attention in mid-2006. Once installed, it displays popup ads with appearance similar to real Microsoft Windows warning popups, informing the user that their computer is infected with spyware. Clicking these popups triggers the download of a fake anti-spyware program (such as Virus Heat and MS Antivirus ((Antivirus 2009)) in which the trojan is hidden. According to F-Secure, a computer security firm, they have discovered 32 variants of this trojan. Other variants continue to be discovered on a daily basis and are added to the detection signatures of various commercial anti-virus products. Some variants of the Zlob family, like the so-called DNSChanger, adds rogue DNS name servers to the Registry of Windows-based computers, network settings of Macintosh computers and attempts to hack into any detected router to change the DNS settings and therefore could potentially re-route traffic from legitimate web sites to other suspicious web sites. The trojan has also been linked to downloading atnvrsinstall.exe which uses the Windows Security shield icon to look as if it is an Anti Virus installation file from Microsoft. Having this file initiated can wreak havoc on computers and networks. One symptom is random computer shutdowns or reboots with random comments. This is caused by the programs using Scheduled Tasks to run a file called "zlberfker.exe". PHSDL - Project Honeypot Spam Domains List tracks and catalogues Zlob spam Domains. Some of the domains on the list are redirects to porn sites and various video watching sites that show a number of inline videos. Clicking on the video to play activates a request to download an ActiveX codec which is malware. It prevents the user from closing the browser in the usual manner. Other variants of Zlob Trojan installation are in the form of computer scan that comes as a Java cab.
- Zlob is a trojan horse which masquerades as a needed video codec in the form of ActiveX. Zlob allows a remote attacker to perform various malicious actions on the compromised computer. It was first detected in late 2005. However, it wasn't until mid-2006 that it started gaining attention. Once installed, it displays popup ads with appearance similar to real Microsoft Windows warning popups, informing the user that their computer is infected with spyware. Clicking these popups trigger the download of a fake anti-spyware program (such as Virus Heat) in which the trojan horse is hidden. According to F-Secure, a computer security firm, they have discovered 32 variants of this trojan. Other variants continue to be discovered on a daily basis and are added to the detection signatures of various commercial anti-virus products. Some variants of the Zlob family, like the so-called DNSChanger, adds rogue DNS name servers to the Registry of Windows-based computers and network settings of Macintosh computers and therefore could potentially re-route traffic from legitimate web sites to other suspicious web sites. The trojan has also been linked to downloading atnvrsinstall.exe which uses the Windows Security shield icon to look as if it is an Anti Virus installation file from Microsoft. Having this file initiated can wreak havoc on computers and networks. One symptom is random computer shutdowns or reboots with random comments. This is caused by the programs using Scheduled Tasks to run a file called "zlberfker.exe". PHSDL - Project Honeypot Spam Domains List tracks and catalogues Zlob spam domains. Some of the domains on the list are redirects to porn sites and various video watching sites that show a number of inline videos. Clicking on the video to play activates a request to download an ActiveX codec which is malware. It prevents the user from closing the browser in the usual manner. Other variants of Zlob Trojan installation are in the form of computer scan that comes as a Java cab. There is evidence that the Zlob trojan might of Russian origin.
|
