Win32:Zlob-JN
Win32:Zlob-JN is a Trojan horse that downloads other Zlob family trojans or other potentially unwanted applications.
| Summary | |
|---|---|
| Type | Trojan |
| Aliases | Trojan-Downloader.Win32.Zlob.aco, Trojan.Downloader.Zlob.ABN |
| VPS version | 0632-0 |
| Platform | Windows |
| Infection length | 36,352; 38,912; 39,424; 41,472; 51,712; 63,488 bytes |
| Mutation | |
| Win32:Zlob-JO | 40,960 bytes |
Description
Win32:Zlob-JN or its mutation is included in the following installation packages:
- intcodec-v6.107.exe
- intcodec-v6.414.exe
- intcodec-v6.556.exe
- sv-codec-light-v1_04b.exe
- sv-codec-v3.exe
- sv-codec-v4_01a.exe
- pornmagpass_ver1.107.exe
- another name is possible
Win32:Zlob-JN or its mutation is placed in %Temp%\nst2.tmp\isecur.dll after launching the installation package. Win32:Zlob-JN or its mutation is used to download other Zlob family trojans or other potentiallly unwanted applications. The following folders are created during the installation process:
- %ProgramFiles%\IntCodec
- %ProgramFiles%\Media-Codec
- %ProgramFiles%\PornMag Pass
All of these folders can be deleted.
Detection/Removal
avast! with VPS file 0632-0 or newer dated on or after 8th August 2006 is able to detect this trojan and its mutation.
