Scan Spyware on Twitter

Tuesday, March 16, 2010

zlob.sunporn

Type: trojan

Alias: win-dropper/zlob.427816, trojan.dnschanger

Description: Zlob.Sunporn is a variant of zlob family, disguised as a video codec that silently downloads other malwares on infected machine.

Malware Threat

Directories

C:\Program Files\SunPorn

Files

C:\Program Files\SunPorn\unins000.exe
C:\Program Files\SunPorn\unins000.dat
viva-codec.v3.535.exe (md5:a39c7870c1ee52a4d50582...)

Registry Keys

HKEY_CLASSES_ROOT\\SunPorn
HKEY_CLASSES_ROOT\\SunPornwrrb325
HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\SunPorn
HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\SunPornwrrb325
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\1_IS1

- rbot.kfRbot.Kf is a network worm that allows a malicious user remote access to an infected computer.
- rbot.kjRbot.KJ is a backdoor worm that spreads through network shares and allows attackers to access and control over infected computer.
- rbot.kmRbot.Km is a worm which attempts to spread to remote network shares. It also contains backdoor trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
- rbot.knRbot.KN is a backdoor worm that spreads through network shares and allows attackers to access and control over infected computer.
- rbot.kphRbot.KPH is a backdoor Worm that spreads through network shares and allows attackers to gain access and full control over the infected computers.
- rbot.kqRbot.KQ is a backdoor worm that spreads through network shares and allows attackers to access and control over infected computer.
- rbot.krRbot.KR is a backdoor worm that spreads through network shares and allows attackers to gain access and full control over the infected computer.

ACROSS THE GLOBE

ACROSS THE GLOBE

IN United States

FROM United States