W32/Breplibot.Z Trojan

 Information about the W32/Breplibot.Z Trojan:

W32/Breplibot.Z is a trojan. The trojan will infect Windows systems and spreads through spammed email.

The subject of the infected mail will be any of the following;

Photo Approval Deadline
photo approval needed
Campus Life

The body of the infected mail will be Hello, .

The name of the infected attachment will be any one of the following;

Photos.zip
Article.zip

The attached zip file contains executable file Photo and Article.exe.

Upon execution, the trojan copies itself as cmssr.exe in the Windows System folder.

The trojan modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The trojan has the backdoor capabilities. It connects to the Internet Relay Chat (IRC) server. After the connection is established, it joins an IRC channel and listens for commands coming from a remote user.

This worm first appeared on May 22, 2006.

 Other names of W32/Breplibot.Z Trojan:

This Worm is also known as W32/Brepibot!8192, BKDR_BREPLIBOT.Z, Troj/Stinx-V, Trojan.Brepibot.U and W32/Brepibot.AA.