No chit, Just checked the history of my anti virus, and it was a password stealer, Never had that happen before..... It deleted it right away. Just wish I knew where it came from.....
This is what the file is called
PWS:win32/zbot
EDIT,,,,,,,,,,,,,,, did some checking, this sure has the smell of gumpie hacks,,,,,,,,,,
Technical Information (Analysis)
PWS:Win32/Zbot is a password-stealing trojan that monitors for visits to certain Web sites. It allows limited backdoor access and control and may terminate certain security-related processes.
Installation
When executed, PWS:Win32/Zbot drops a copy of itself as any of the following files:
\ntos.exe
\sdra64.exe
\twex.exe
Note - refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.
It also drops the following files, containing encrypted data used by the trojan, under the folder "\wsnpoem\":
audio.dll
video.dll
It also creates the following encrypted log file, in which it presumably writes all stolen data:
\twain_32\user.ds
PWS:Win32/Zbot modifies the registry to ensure that its copy is executed at each Windows start:
Adds value: "userinit"
With data: "\userinit.exe,\"
To subkey: HKLM\Software\Microsoft\Windows NT\Currentversion\Winlogon
where is any of the file names mentioned above.
It also injects its code in the following processes:
explorer.exe
lsass.exe
svchost.exe
winlogon.exe
PWS:Win32/Zbot also hides its processes and registry entry to avoid detection.
Payload
Steals sensitive data
PWS:Win32/Zbot steals login credentials whenever a user goes to certain Web sites, such as the following:
https://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome
https://www.e-gold.com/sci_asp/payments.asp
It also monitors if the computer opens the "WebMoney Keeper Classic" program.
It may also attempt to steal the following sensitive information from the computer:
Certificates
Cached passwords
Cookies
Allows backdoor access and control
PWS:Win32/Zbot may download a configuration file from the Internet, which is capable of doing the following:
Rename the bot
Get certificates
Block URLs
Unblock URLs
Delete files
Download files
Terminates security processes
PWS:Win32/Zbot checks for the following security-related processes and terminates them if found:
outpost.exe (executable for Outpost Firewall)
zlclient.exe (executable for Zone Alarm Firewall)
Analysis by Francis Allan Tan Seng
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=PWS:Win32/Zbot
| 
