Zeus/Zbot Banking Trojan/Data Theft (credentialed check)
Critical Nessus Plugin ID 45085
SynopsisThe remote Windows host has been infected with the Zeus/Zbot trojan.
DescriptionThe remote Windows host has files that indicate that the Zeus (also known as Zbot) banking trojan has been installed, or that stolen data collected by this trojan remains on the system.
The Zeus trojan will intercept and log activity related to online banking, as well as other logins, such as web, ftp, email, etc, and report these credentials to a third party. The targeted credentials are unique per Zeus infection, so any website can be affected.
Zeus also gives the attacker complete control over the system, allowing for further malware to be installed, the ability to proxy traffic through an infected host, and other things like the ability to kill the system.
False positives may occur if file names identical to files Zeus creates are detected on the system. These file names mimic standard Windows files, and should be considered suspicious under any circumstances.
SolutionUpdate the host's antivirus software, clean the host, and scan again to ensure its removal. If symptoms persist, re-installation of the infected host is recommended.