Click Here to Install Silverlight*
United StatesChange|All Microsoft Sites
Microsoft
Security 

Malicious Software Encyclopedia: Win32/Zindos

Published: May 16, 2005

Win32/Zindos is a worm that targets computers running the following Microsoft Windows 9x, Windows ME, Windows NT, Windows 2000, and Windows XP. The worm spreads to computers that are already infected by the mass-mailer worm Win32/Mydoom.O@mm. Win32/Zindos may perform a denial of service (DoS) attack against certain Web sites.

**

Related Links

•

Removal Tools - Microsoft

Glossary Terms

Click the term to get the definition from our Security Glossary.

•

Trojan horse

•

virus

•

worm

**
On This Page
Threat OverviewThreat Overview
Aliases (Also Known As)Aliases (Also Known As)
Technical AnalysisTechnical Analysis
How to Prevent InfectionHow to Prevent Infection
How to Tell If Your Computer Is InfectedHow to Tell If Your Computer Is Infected
How to Recover from InfectionHow to Recover from Infection
Transmission MethodsTransmission Methods
Payload InformationPayload Information
Modified Registry EntriesModified Registry Entries
Dropped FilesDropped Files

Threat Overview

Class/typeWorm - Program-specific
DiscoveredJuly 27, 2004
CirculatingYes
Affected operating systemsWindows NT 4.0
Windows 95
Windows 2000
Windows XP
Affected software Not specified
Infection ratingLow
Recovery difficultyEasy
Damage ratingMedium
Transmission ratingMedium

Aliases (Also Known As)

Different antivirus vendors may be using different names to refer to this malicious software. Here are some of the names currently in use by antivirus software vendors participating in the Microsoft Virus Information Alliance (VIA):

  • CA: Win32/Zindos
  • F-secure: Zindos
  • McAfee: W32/Zindos.worm
  • Symantec: W32.Zindos
  • Trend Micro: WORM_ZINDOS

    • Learn more about the Microsoft Virus Information Alliance.

    Technical Analysis

    The Win32/Zindos worm spreads through a backdoor that is created by the mass-mailer worm Win32/Mydoom.O@mm. The backdoor then runs Win32/Zindos. When Win32/Zindos runs, it adds a value to registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The registry value contains the worm path, so that the worm runs whenever Windows starts. The worm may create multiple threads to launch denial of service (DoS) attacks against certain Web sites.

    How to Prevent Infection

    Take the following steps to help prevent infection on your system:
    • Enable a firewall on your computer
    • Get the latest computer updates
    • Use up-to-date antivirus software
    • Use caution with unknown attachments

    Enable a firewall on your computer

    Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
    To turn on the Internet Connection Firewall in Windows XP
    1. Click Start, and click Control Panel.
    2. Click Network and Internet Connections, and click Network Connections. If you do not see Network and Internet Connections, click Switch to Category View.
    3. Highlight a connection that you want to help protect, and click Change settings of this connection.
    4. Click Advanced, and select Protect my computer and network by limiting or preventing access to this computer from the Internet.
    5. Click OK.

    Get the latest computer updates

    Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
    To turn on Automatic Updates
    1. Click Start, and click Control Panel.
    2. Click Performance and Maintenance. If you do not see Performance and Maintenance , click Switch to Category View.
    3. Click System.
    4. Click Automatic Updates, and select Keep my computer up to date.
    5. Select a setting. Microsoft recommends selecting Automatically download the updates, and install them on the schedule that I specify and setting a regular update time.
    6. If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.

    Use up-to-date antivirus software

    Most antivirus software can detect and prevent infection by known malicious software. You should always run antivirus software on your computer that is updated with the latest signature files to automatically help protect you from infection.

    Use caution with unknown attachments

    Use caution before opening unknown e-mail or IM attachments, even if you know the sender. If you cannot confirm with the sender that a message is valid and that an attachment is safe, delete the message immediately, and run up-to-date antivirus software to check your computer for viruses.

    How to Tell If Your Computer Is Infected

    You may notice system performance degradation and slower network connectivity if your computer is infected by Win32/Zindos.

    How to Recover from Infection

    Automatic Recovery
    To attempt to automatically remove this threat, run one of the following removal tools:

    Manual Recovery

     

    Transmission Methods

    MethodDescription
    Exploits VulnerabilitySpreads through a backdoor created by Win32/Mydoom.O@mm.

    Payload Information

    Payload typeTriggerDescription
    Degrades Performance
    Upon infection
    Launches DoS attacks against www.microsoft.com
    Degrades Performance
    Upon infection
    Exhausts system resources by continuously creating threads for DoS attacks

    Modified Registry Entries

    Changed registry entries
    KeyHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Value nameTray [String]
    Old value
    New value<worm executable path> [String]

    Dropped Files

    Path%Temp%\<random>.exe

    © 2009 Microsoft Corporation. All rights reserved. Contact Us |Terms of Use |Trademarks |Privacy Statement