Notice
This is a Low-Profiled Threat Notice for PWS-Zbot

Justification
PWS-Zbot has been deemed Low-Profiled due to media attention at http://www.theregister.co.uk/2009/01/21/ai...t_malware_scam/.

PWS-Zbot is referred to as "Agent-IPS Trojan" in article at theregister.co.uk.

Read About It
Information about PWS-Zbot is located on VIL at: http://vil.nai.com/vil/content/v_143802.htm

Detection
PWS-Zbot was first discovered on December 19, 2007 and detection this particular variant was added to the 5496 dat files as Generic PWS.o (Release Date: January 15, 2009).
The 5503 DATs (Release date: January 22, 2009) will detect these as PWS-Zbot.

To stay updated and protected download the latest dat files from http://www.mcafee.com/us/downloads/index.html

If you suspect you have PWS-Zbot, please submit a sample to http://www.webimmune.net

Risk Assessment Definition
For further information on the Risk Assessment and Avert Labs Recommended Actions please see: http://www.mcafee.com/us/threat_center/out...assessment.html

For breaking security information from McAfee® Avert® Labs visit:

McAfee Avert Labs Blog
http://www.avertlabs.com/research/blog