Troj/Zapchas-EE

Please follow the instructions for removing Trojans.

Troj/Zapchas-EE is a Trojan for the Windows platform.

When Troj/Zapchas-EE is installed the following files are created:

<Temp>\spool\aliases.ini
<Temp>\spool\control.ini
<Temp>\spool\dr.mrc
<Temp>\spool\ident.txt
<Temp>\spool\july.jpg
<Temp>\spool\mirc.ico
<Temp>\spool\mirc.ini
<Temp>\spool\perform.ini
<Temp>\spool\popups.txt
<Temp>\spool\remote.ini
<Temp>\spool\servers.ini
<Temp>\spool\spoolsv.exe
<Temp>\spool\taskbar.dll
<Temp>\spool\users.ini

The file taskbar.dll is detected as Troj/Bckdr-QND. The file mirc.ini is detected as Mal/Zapchas-C. The file spoolsv.exe is a legitimate binary of the mIRC application. The files july.jpg and mirc.ico are image files. The files dr.mrc and remote.ini are also detected as Troj/Zapchas-EE. The remaining files are text and can be safely deleted.

The following registry entry is created to run Troj/Zapchas-EE on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
spoolsv
<Temp>\spool\spoolsv.exe\

Registry entries are set as follows:

HKLM\SYSTEM\CurrentControlSet\Services\svchost\Parameters
Application
<Temp>\spool\spoolsv.exe\

HKLM\SYSTEM\CurrentControlSet\Services\svchost\Parameters
AppDirectory
<Temp>\spool\spoolsv.exe\

Registry entries are created under:

HKCU\Software\mIRC\License
HKCU\Software\mIRC\LockOptions
HKCU\Software\mIRC\UserName