Trojan:Win32/VB.ZD

Trojan:Win32/VB.ZD is a trojan written in Visual Basic that terminates several security related processes.

Installation

When executed, the trojan drops drops a copy of itself as mac.exe in the %USERPROFILE% folder.

It then creates the following registry entry to ensure that its copy executes at each Windows start:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "mac"
With data: "<Computer name>\mac.exe"

Payload

Terminates Processes

Trojan:Win32/VB.ZD monitors the running processes in the infected computer, and checks if any of the following process names are present, and if found, terminates them:

• AVGIDSAgent.exe
• Avast.Setup
• Avast.setup
• AvastSvc.exe
• AvastUI.exe
• avast.setup
• avgchsvx.exe
• avgcsrvx.exe
• avgemcx.exe
• avgidsmonitor.exe
• avgnsx.exe
• avgrsx.exe
• avgtray.exe
• avgui.exe
• avgwdsvc.exe

Additional information

Trojan:Win32/VB.ZD may be dropped or bundled with Worm:Win32/Ructo.J or Win32/Banker variants.

Analysis by Ric Robielos