W32/Zapchas.AD Trojan

 Information about the W32/Zapchas.AD Trojan:

W32/Zapchas.AD is a trojan. The trojan will infect Windows systems and spreads through email.

Upon execution, the trojan copies following files in the Windows System folder.

script.ini
users.ini
svchost.exe
mirc.ini
sup.reg
remote.ini
sup.bat
servers.ini
aliases.ini
poza.exe
nicks.txt
fullname.txt
mirc.ico
ident.txt
control.ini

It opens the poza.exe archive file using the default image viewer.

The trojan modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Run

The trojan has the backdoor capabilities. It connects to the Internet Relay Chat (IRC) server. After the connection is established, it joins an IRC channel and listens for commands coming from a remote malicious user.

This worm first appeared on December 09, 2005.

 Other names of W32/Zapchas.AD Trojan:

This Worm is also known as Troj/Zapchas-AD.