| 词条 | Zlob trojan |
| 释义 |
The Zlob Trojan, identified by some antiviruses as Trojan.Zlob, is a Trojan horse which masquerades as a needed video codec in the form of ActiveX. It was first detected in late 2005, but only started gaining attention in mid-2006.[1] Once installed, it displays popup ads with which appear similar to real Microsoft Windows warning popups, informing the user that their computer is infected with spyware. Clicking these popups triggers the download of a fake anti-spyware program (such as Virus Heat and MS Antivirus (Antivirus 2009)) in which the Trojan horse is hidden.[1] The Trojan has also been linked to downloading atnvrsinstall.exe which uses the Windows Security shield icon to look as if it is an anti-virus installation file from Microsoft. Having this file initiated can wreak havoc on computers and networks. One typical symptom is random computer shutdowns or reboots with random comments. This is caused by the programs using Task Scheduler to run a file called "zlberfker.exe." Project Honeypot Spam Domains List (PHSDL)[2] tracks and catalogs spam domains. Some of the domains on the list are redirects to porn sites and various video watching sites that show a number of inline videos. Playing the video activates a request to download an ActiveX codec which is malware. It prevents the user from closing the browser in the usual manner. Other variants of Zlob Trojan installation come in the form of a Java cab file masquerading as a computer scan.[3] There is evidence that the Zlob Trojan might be a tool of the Russian Business Network[4] or at least of Russian origin.[5] RSPlug, DNSChanger, and other variantsThe group that created Zlob has also created a Mac Trojan with similar behaviors (named RSPlug).[6] Some variants of the Zlob family, like the so-called "DNSChanger", add rogue DNS name servers to the registry of Windows-based computers[7] and attempt to hack into any detected router to change the DNS settings, potentially re-routing traffic from legitimate web sites to other suspicious web sites.[8] DNSChanger in particular gained significant attention when the U.S. FBI announced it had shut down the source of the malware in late-November 2011.[9] However, as there were millions of infected computers which would lose access to the internet if the malware group's servers were shutdown, the FBI opted to convert the servers into legitimate DNS servers. Due to cost concerns, however, these servers are set to shut down on the morning of 9 July 2012, which could cause thousands of still-infected computers to lose internet access.[10] This server shutdown did occur as planned although the expected issues with infected computers did not materialize. By the date of the shutdown there were many free programs available that removed the Zlob malware effectively and without great technical knowledge. The malware did however remain in the wild and as at 2015 could still be found on unprotected computers. The malware was also self replicating, something the FBI did not fully understand, and the servers that were shutdown may have only been one of the initial sources of the malware. Current antivirus programs are very effective at detecting and removing Zlob and its time in the wild appears to be coming to an end. See also
References1. ^1 {{cite web|url=http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VNAME=The+ZLOB+Show%3A+Trojan+poses+as+fake+video+codec%2C+loads+more+threats|title=The ZLOB Show: Trojan Poses as Fake Video Codec, Loads More Threats|publisher= Trend Micro|accessdate=2007-11-26}} 2. ^[https://www.projecthoneypot.org/list_of_ips.php?t=s Project Honeypot Spam Domains List] 3. ^PHSDL Zlob Trojan Forum Spam Hijacking Attempt Documentation 4. ^http://rbnexploit.blogspot.com/2007/11/rbn-fake-codecs.html 5. ^http://t-c-p.narod.ru/gr0031.htm 6. ^{{cite web|url=http://www.news.com/Multiplying-Mac-Trojan-not-epidemic-yet/2100-7349_3-6217540.html|title=Multiplying Mac Trojan not epidemic yet|last=Tung|first=Liam|date=2007-11-08|publisher=CNET News|accessdate=2007-11-26}} 7. ^{{cite web|url=http://www.f-secure.com/v-descs/dnschang.shtml|title=F-Secure Virus Descriptions: DNSChanger|last=Podrezov|first=Alexey|date=2005-11-07|publisher=F-Secure Corporation|accessdate=2007-11-26}} 8. ^{{cite news |url=http://www.spywareloop.com/infections/z/zlob-trojan|title=Zlob Trojan in SpyWareLoop.com|author= Vincentas |newspaper=Spyware Loop |date=9 July 2013 |accessdate=28 July 2013}} 9. ^{{cite web |url=https://www.fbi.gov/news/stories/2011/november/malware_110911/malware_110911 |title=International Cyber Ring That Infected Millions of Computers Dismantled |publisher=U.S. FBI |date=9 November 2011 |accessdate=6 June 2012}} 10. ^{{cite web |url=http://news.cnet.com/8301-1023_3-57447967-93/facebook-warns-users-of-the-end-of-the-internet-via-dnschanger/ |title=Facebook warns users of the end of the Internet via DNSChanger |author=Kerr, Dara |publisher=CNET |date=5 June 2012 |accessdate=6 June 2012}} External links
4 : Adware|Trojan horses|Windows trojans|Hacking in the 2000s |
| 随便看 |
|
开放百科全书收录14589846条英语、德语、日语等多语种百科知识，基本涵盖了大多数领域的百科知识，是一部内容自由、开放的电子版国际百科全书。