Content
Downloader-ZQ
- Type
- Trojan
- SubType
- Downloader
- Discovery Date
- 04/25/2005
- Length
- Minimum DAT
- 4476 (04/25/2005)
- Updated DAT
- 5715 (08/20/2009)
- Minimum Engine
- 5.1.00
- Description Added
- 04/25/2005
- Description Modified
- 07/21/2005 9:49 AM (PT)
Tab Navigation
Characteristics
Downloaders are designed to pull files from a remote website and execute the files that have been downloaded.
As it is trivial for the malware author to modify the Downloader to refer to a different website or web address, McAfee write detection routines for Downloaders which as a general rule do not include these strings in the detection routines.
This allows McAfee to write more generic detections for these threats and to proactively protect customers against future minor variants.
The Trojan copies itself as %sysdir%\symcsvc.exe (this is observed to change with variants)
Related File Names:
- symcsvc.exe
- ~update.exe
- latest.exe
Creates a mutex named "_galapoper".
Downloader-ZQ contacts various IP addresses to get different commands. It may contact various php scripts on these IPs with multiple parameters. These PHP scripts returns commands back to the binary, based on the input parameters.
To get the commands it is seen to contact following IP addresses
- 217.159.201.135
- 69.50.171.170
These IP addresses can also belong to legitimate sites, the creator of this trojan tend to hack vulnerable sites to place its own php scripts to be contacted later. It is also observed to download Adware-SpySheriff, and fake spyware warning screen.
The trojan carries its own SMTP engine to create marketing related SPAM mails. An example of such a mail can be
It also keep track of the reply from server, for example if any server denies access to its mail or the spam address is wrong, the trojan maintains a log of it and could use it in future, e.g. for eliminating those addresses from its SPAM list.
Registry Changes
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Run\wupd: "C:\WINDOWS\System32\symcsvc.exe" - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperFileTime: FB 9B B7 1D 80 8D C5 01
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperLocalFileTime: FB C3 58 71 45 8D C5 01
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\CurrentState: 0x40000004
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer\NoActiveDesktop: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer\ClassicShell: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer\ForceActiveDesktopOn: 0x00000001 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoChangingWallpaper: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoComponents: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoAddingComponents: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoDeletingComponents: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoEditingComponents: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoHTMLWallPaper: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\System\Wallpaper: "C:\WINDOWS\desktop.html" - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run\Windows installer: "C:\winstall.exe" - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run\SNInstall: "C:\WINDOWS\System32\~update.exe" - HKEY_CURRENT_USER\Software\Install\Version: 0x00000000
Files Added
- %sysdir%\zlbw.dll (innocent libarary)
- %sysdir%\symcsvc.exe
- %sysdir%\~update.exe
- %windir%\desktop.html
- C:\winstall.exe
- C:\Documents and Settings\(current user)\Application Data\Install.dat (SpySheriff Installer)
Adware-SPySheriff added following files
- C:\Program Files\SpySheriff\found.wav
- C:\Program Files\SpySheriff\IESecurity.dll
- C:\Program Files\SpySheriff\notfound.wav
- C:\Program Files\SpySheriff\ProcMon.dll
- C:\Program Files\SpySheriff\removed.wav
- C:\Program Files\SpySheriff\SpySheriff.dvm
- C:\Program Files\SpySheriff\SpySheriff.exe
- C:\Program Files\SpySheriff\SpySheriff_1.dat
- C:\Program Files\SpySheriff\SpySheriff_2.dat
- C:\Program Files\SpySheriff\Uninstall.exe
Symptoms
Presence of the aforementioned files and registry entries.
Method of Infection
N/A. Downloaders are not viruses, and as such do not themselves contain any method to replicate. However they may themselves be downloaded by other viruses and/or Trojans to be installed on the user's system.
Many of these additionally are mass spammed by the author to entice people into double-clicking on them.
Alternatively they may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the Downloader onto the user's system with no user interaction.
Removal
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Variants
Variants
N/A
All Information
Overview -
This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
Characteristics
Characteristics -
Downloaders are designed to pull files from a remote website and execute the files that have been downloaded.
As it is trivial for the malware author to modify the Downloader to refer to a different website or web address, McAfee write detection routines for Downloaders which as a general rule do not include these strings in the detection routines.
This allows McAfee to write more generic detections for these threats and to proactively protect customers against future minor variants.
The Trojan copies itself as %sysdir%\symcsvc.exe (this is observed to change with variants)
Related File Names:
- symcsvc.exe
- ~update.exe
- latest.exe
Creates a mutex named "_galapoper".
Downloader-ZQ contacts various IP addresses to get different commands. It may contact various php scripts on these IPs with multiple parameters. These PHP scripts returns commands back to the binary, based on the input parameters.
To get the commands it is seen to contact following IP addresses
- 217.159.201.135
- 69.50.171.170
These IP addresses can also belong to legitimate sites, the creator of this trojan tend to hack vulnerable sites to place its own php scripts to be contacted later. It is also observed to download Adware-SpySheriff, and fake spyware warning screen.
The trojan carries its own SMTP engine to create marketing related SPAM mails. An example of such a mail can be
It also keep track of the reply from server, for example if any server denies access to its mail or the spam address is wrong, the trojan maintains a log of it and could use it in future, e.g. for eliminating those addresses from its SPAM list.
Registry Changes
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Run\wupd: "C:\WINDOWS\System32\symcsvc.exe" - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperFileTime: FB 9B B7 1D 80 8D C5 01
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperLocalFileTime: FB C3 58 71 45 8D C5 01
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\CurrentState: 0x40000004
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer\NoActiveDesktop: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer\ClassicShell: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer\ForceActiveDesktopOn: 0x00000001 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoChangingWallpaper: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoComponents: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoAddingComponents: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoDeletingComponents: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoEditingComponents: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\ActiveDesktop\NoHTMLWallPaper: 0x00000000 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\System\Wallpaper: "C:\WINDOWS\desktop.html" - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run\Windows installer: "C:\winstall.exe" - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run\SNInstall: "C:\WINDOWS\System32\~update.exe" - HKEY_CURRENT_USER\Software\Install\Version: 0x00000000
Files Added
- %sysdir%\zlbw.dll (innocent libarary)
- %sysdir%\symcsvc.exe
- %sysdir%\~update.exe
- %windir%\desktop.html
- C:\winstall.exe
- C:\Documents and Settings\(current user)\Application Data\Install.dat (SpySheriff Installer)
Adware-SPySheriff added following files
- C:\Program Files\SpySheriff\found.wav
- C:\Program Files\SpySheriff\IESecurity.dll
- C:\Program Files\SpySheriff\notfound.wav
- C:\Program Files\SpySheriff\ProcMon.dll
- C:\Program Files\SpySheriff\removed.wav
- C:\Program Files\SpySheriff\SpySheriff.dvm
- C:\Program Files\SpySheriff\SpySheriff.exe
- C:\Program Files\SpySheriff\SpySheriff_1.dat
- C:\Program Files\SpySheriff\SpySheriff_2.dat
- C:\Program Files\SpySheriff\Uninstall.exe
Symptoms
Symptoms -
Presence of the aforementioned files and registry entries.
Method of Infection
Method of Infection -
N/A. Downloaders are not viruses, and as such do not themselves contain any method to replicate. However they may themselves be downloaded by other viruses and/or Trojans to be installed on the user's system.
Many of these additionally are mass spammed by the author to entice people into double-clicking on them.
Alternatively they may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the Downloader onto the user's system with no user interaction.
Removal -
Removal -
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
