When installed on the computer, PWS-Zbot.gen.v will also perform the following:
It will modify Windows Registry and add the following entry:
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon] “Userinit” = “C:\WINDOWS\system32\userinit.exe, C:\WINDOWS\system32\sdra64.exe”
The threat will drop the following malicious files:
- %SysDir%\lowsec\local.ds
- %SysDir%\lowsec\user.ds
- %SysDir%\lowsec\user.ds.lll
- %SysDir%\sdra64.exe
