Zlob (Trojan.Zlob)

Manual IEDefender removal

admin — Sat, 14 Jun 2008 20:26:00 +0000

To remove IEDefender manualy You must delete these DLL files:

mp3avi.dll
alisj.dll

stop processes:

IEDefender.exe

delete files:

IE Defender.exe
mp3avi.dll
alisj.dll
IEDefender.lnk

and remove registry entry:

Microsoft\Windows\CurrentVersion\App Paths\IEDefender.exe

IEDefender

admin — Tue, 10 Jun 2008 18:26:16 +0000

IEDefender is a fake anti-spyware software that presents itself as a legitimate spyware remover, while it actually infects the computer itself and tries to trick the user into buying its full version. DO NOT trust this parasite, as IE Defender is a scam designed to milk money from unsuspecting gullible users. Ie Defender Shows excessive popup ads which pushed users to download and purchase the program.

Whats is Trojan Downloader?

admin — Mon, 26 May 2008 20:49:05 +0000

A Trojan Downloader is a program that is usually installed through an exploit or some other erroneous channels. The key objective of this program is to download malevolent code or other malwares and unwanted softwares on the user’s system. Downloaders can also be written in script languages such as VB Script and Java Script. These programs often make use of Microsoft Internet Explorer vulnerabilities. A Trojan downloader, when executed, normally installs itself on to the system and waits for the user to connect to the Internet. Once the internet connection is available, it endeavors to connect to a web or ftp site, download specific file or files and run them. These downloaded files may harm the system and result in malfunctioning of the system.

Trojan-Downloader.Zlob.CEE

admin — Mon, 26 May 2008 20:43:59 +0000

Trojan-Downloader.Zlob.CEE attempts to download and install other malicious files on affected system.

Also known as:

Trojan-Downloader.Win32.Zlob.cee [Kaspersky], Trojan.Zlob [Symantec]

Threat level:

High

Type:

TT_Downloader, TT_Trojan

Trojan-Downloader.Zlob.AV

admin — Mon, 26 May 2008 20:37:40 +0000

Trojan.Downloader.Zlob.AV is a trojan which on execution downloads other malware from the internet.

Threat level:

High

Type:

TT_Trojan

Processes to kill:

2e1b03c5.exe

Trojan-Downloader.Zlob.AS

admin — Thu, 08 May 2008 19:21:38 +0000

Trojan.Downloader.Zlob.AS belongs to a family of Zlob Trojans which attempt to hide themselves by injecting into other system processes or by registering themselves as a service process. The Trojan can also create folders in the Windows system directory and store downloaded files in these folders.

Also known as:

Trojan-Downloader.Win32.Zlob.ak

Threat level:

High

Systems affected:

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Trojan-Downloader.Zlob.AND

admin — Wed, 07 May 2008 19:04:04 +0000

Trojan.Downloader.Zlob.AND contacts a remote server in order to download additional malware onto a users computer without their knowledge.

Also known as:

Trojan-Downloader.Win32.Zlob.and

Threat level:

High

Systems affected:

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Type:

TT_Trojan

Trojan.Zlob.C

admin — Tue, 06 May 2008 17:07:34 +0000

Trojan.Zlob.C is a Trojan downloader which installs as a driveby and upon execution downloads additional malware to infect the target machine.

Threat level:

High

Systems affected:

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Type:

T_Trojan, TT_Downloader

Zlob (Trojan.Zlob)

admin — Mon, 05 May 2008 19:26:48 +0000

What is Trojan.Zlob?

Trojan.Zlob (Zlob.Trojan or Trojan.Zlob) is a backdoor Trojan that allows the remote attacker to perform various malicious actions on the compromised computer. It allows to install all malicious softwares to your computer. It can also delete and modify files, and put your privacy in danger.

What is Trojan horse?

Trojan horse is a piece of software which appears to perform a certain action but in fact performs another such as a computer virus. Contrary to popular belief, this action, usually encoded in a hidden payload, may or may not be actually malicious, but Trojan horses are notorious for their use in the installation of backdoor programs.

What does Zlob do?

Zlob.Trojan is known to install fake anti-spyware program such as IE Defender, AntiVirGear, VirusProtect, SpyCrush and SpyLocked. Therefore, it’s very critical to remove Zlob from from your computer if it was infected. If you are familiar with registry edit and dll files in Windows, we strongly recommend you to try Zlob manual removal instructions. It might take time and patience, but it is equally effective if you get it right. If you are not familiar with registry editing we strongly recommend automatic spyware removal tool.

What systems does it effect?

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP, Windows Vista

What is Trojan.Zlob threat level?

High and very dangerous

What registry values does it add?

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunRegSvr32=%System%msmsgs.exe
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsNTCurrentVersionWinlogonShell=explorer.exe

What files does it create?

uimcu.dll
antzozc.dll
dtjby.dll
dumpserv.com
zxserv0.com
vnp7s.net
Protect
RSA
ncompat.tlb
msvol.tlb
hp[X].tmp
msmsgs.exe
dumpserv.com nvctrl.exe
zxserv0.com
vnp7s.net
%UserProfile%\Application Data\Microsoft\Protect
%UserProfile%\Application Data\Microsoft\Crypto\RSA
ncompat.tlb
msvol.tlb
hp[X].tmp

Variants of Zlob?

Trojan.Zlob.C, Trojan.Zlob, Trojan, Downloader.Win32.Zlob, Downloader-XC, Generic Downloader.gen.bd, Puper [McAfee], Troj/Zlob-CD, TROJ_ZLOB, Trojan.Downloader.Zlob.AND