W32/Zlob.M is a trojan. The trojan will infect Windows systems and may redirect the Internet Explorer home page and search page to potentially malicious Web sites.

It may also display fake error messages.

Upon execution, the trojan creates isamntr.exe, isamini.exe, isadd.dll, pmsnrr.exe and pmmnt.exe in the current folder itself.

It modifies the registry at the following locations;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}

The trojan redirects the Internet Explorer home page to the following URL regardless of the registry settings:
[http://]www.asecur(Blocked)

It also redirects all Internet Explorer address bar searches and page not found errors to the following URL:
[http://]www.ie40(Blocked)

The trojan displays the following fake error messages from the System Tray claiming that the computer is infected:

Title:
System Alert: Trojan-Spy.Win32@mx

Message:
Type: Spyware/Trojan
Vulnerable: Windows 95/98/ME/NT/2003/Windows XP
Description: Spyware program that sends confidential information to a remote attacker
Protection: Click this baloon to download official security software

Title:
Critical System Warning!

Message:
[Displays a message that pretends to detect a security risk and prompts a download of antispyware software]

This trojan first appeared on February 27, 2007.

 Other names of W32/Zlob.M Trojan:

This trojan is also known as Trojan.Zlob.M.