Emsisoft Malware-Info

Name: Adware.Win32.Zeus

Risklevel: High Risk

Description:

Zeus is a bad applications that can steal your important information, like online banking accounts. This is same description from the authors, "Zeus is software to steal personal user data from remote system...". Zeus is the most popular financial malware on the Net today. a-squared Anti-Malware detects this malware as Trojan-Spy.Win32.Zbot. Zeus is also known as Zbot, Kollah, Pakes, PWSZbot, Banker, or Wsnpoem.

Zeus contains the following modules:
- Zeus Web Control Panel (to control the botnet)

- Zeus Builder (to create the bot, and to encrypt the configuration file)

- Zeus BackConnect

Bot is written in C++, and its encrypted. Usually, the bot spreads by email. At the infected machine, he will contact the server to request a configuration file that contains a list of sites that are mostly online banking.

From one of our sample, this malware have such as characteristics:

* The bot file using fake version information.

* When executed, its try to copy itself to the following location, appends a random of data (junk) at the end of the file, and also its hidden from Explorer, because its hook API NtQueryDirectoryFile: %SystemRoot%\System32\sdra64.exe

* The bot may then create some of the following files, and its hidden too:
- %SystemRoot%\System32\lowsec\local.ds

- %SystemRoot%\System32\lowsec\user.ds

- %SystemRoot%\System32\lowsec\user.ds.lll

* It creates one of the following mutexes:
- _AVIRA_2110

- _AVIRA_2101

- _AVIRA_2108

- _AVIRA_2109

- _AVIRA_21099

* Then it enumerates process to checks for the presence of the following programs:
- outpost.exe (Outpost Personal Firewall)

- zlclient.exe (ZoneLabs Firewall)

* Inject its own code to the following process:
- winlogon.exe

- svchost.exe

- explorer.exe

* It also modify the registry entry, so the bot can run automatically.

* Once decrypted, we seen some interesting strings:
Asystem

Asoftware

Awinsta0

ASetErrorMode

A*%u.%u.%u.%u*

Adefault

Agdiplus.dll

Aole32.dll

Agdi32.dll

ADISPLAY

AGdiplusStartup

AGdiplusShutdown

AGdipCreateBitmapFromHBITMAP

AGdipDisposeImage

AGdipGetImageEncodersSize

AGdipGetImageEncoders

AGdipSaveImageToStream

ACreateStreamOnHGlobal

ACreateDCA

ACreateCompatibleDC

AGetDeviceCaps

ACreateCompatibleBitmap

ASelectObject

ABitBlt

ADeleteObject

ADeleteDC

Areboot

Ashutdown

Aresetgrab

Aupcfg

Akbot

Arename_bot

Agetcerts

Agetmff

Adelmff

Asethomepage

Abc_add

Abc_del

Ablock_url

Aunblock_url

Ablock_fake

Aunblock_fake

Akos

Arexeci

Arexec

Alexeci

Alexec

Aapplication/x-www-form-urlencoded

AContent-Type: %s

ZCID: %s

AKeys:

ATYPE

AFEAT

APASV

ASTAT

ALIST

Aanonymous

Ahttps://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome

ACustomerServiceMenuEntryPoint?custAction=75

AQ%u: %s

A%u: %s

AAccept-Encoding:

Agetfile

Aaddsf

Adelsf

AGRABBED TAN:

ASKIPPED TAN:

lowsec

user.ds

local.ds

sdra64.exe

SYSTEM

winlogon.exe

svchost.exe

explorer.exe

$UID

_AVIRA_2110

_AVIRA_2101

_AVIRA_2108

_AVIRA_2109

_AVIRA_21099

userinit

software\microsoft\windows nt\currentversion\network

software\microsoft\windows nt\currentversion\winlogon

software\microsoft\windows\currentversion\run

csrss.exe

%s_%08X

%08X%08X%08X%X

ntdll.dll

outpost.exe

zlclient.exe

image/jpeg

screens\%s\%04X_%08X.jpg

drivers\etc\hosts

%08X.uf

*.uf

pass

software\microsoft\windows\currentversion\explorer\comdlg32

filesearch\%06X_%s

certs\%s_%02u_%02u_%04u.pfx

Removal instructions for Adware Zeus:

To delete this malware infection, buy Emsisoft Anti-Malware.
Guaranteed removal of Adware Zeus.

Run a full scan on all drives and move all detected items to the quarantine.

More details about this danger:

Installation: Installed through EXE

Process: sdra64.exe

Screenshots:

ZeusZeusZeusZeusZeus

Used folders:

  • C:\Windows\System32\
  • C:\Windows\System32\lowsec\

Used files:

  • C:\Windows\System32\sdra64.exe
    [505344 Bytes] Executable
  • C:\Windows\System32\lowsec\local.ds
    [0 bytes] DS File
  • C:\Windows\System32\lowsec\user.ds
    [0 bytes] DS File
  • C:\Windows\System32\lowsec\user.ds.lll
    [1088 Bytes] lll File

Additional information might be found here:

Search at Google for Adware Zeus Search at Google for Adware Zeus
Search at Bing for Adware Zeus Search at Bing for Adware Zeus
Search at Yahoo for Adware Zeus Search at Yahoo for Adware Zeus

How can I protect myself from Adware Zeus?

Important!
You essentially need an antivirus product, that is not only able to clean infections, but also protect your PC permanently from new dangers. This is the only way to prevent data loss and unnecessary hassle and costs of new installations of your operating system.

Take your chance and buy the multiple awarded protection software Emsisoft Anti-Malware today!

Only $40 for the security of your computer.

Buy Emsisoft Anti-Malware online:

Buy Emsisoft Anti-Malware now

Trust only on the best protection software!

Spring Offer!

Don't miss this: To your bought 1-year license of Emsisoft Anti-Malware or Emsisoft Internet Security Pack or higher you can now get a free license of the CyberGhost Anonymizer for free.
Your advantage: Surf anonymously and visit websites that are restricted in your country.

Only a few days left! Order here

Best In Test!

Emsisoft Anti-Malware is the best of 19 tested antivirus programs - Test by MRG - Malware Research Group - Q1-Q3 2011
More independent reviews of anti-malware software