Threat Search: 

ThreatExpert's Statistics for Spy-Agent.eh [McAfee]:

Spy-Agent.eh [McAfee] is also known as:
Threat AliasNumber of Incidents
Trojan-Spy.Win32.Zbot.gen [Kaspersky Lab]60
Mal/Zbot-O [Sophos]58
Packed.Generic.232 [Symantec]55
PWS:Win32/Zbot.gen!R [Microsoft]51
HeurEngine.MaliciousPacker [PC Tools]18
Trojan-Spy.Win32.Zbot [Ikarus]16
PWS:Win32/Zbot.PM [Microsoft]2
Win-Trojan/Zbot.81920.C [AhnLab]2
Mal/Generic-A, Mal/Zbot-O [Sophos]1
PWS:Win32/Zbot.gen!W [Microsoft]1
Troj/Spy-CU [Sophos]1
Win-Trojan/Zbot.81408.N [AhnLab]1

Spy-Agent.eh [McAfee] has the following possible country of origin:
OriginNumber of Incidents
Russian Federation1

Spy-Agent.eh [McAfee] is known to be created as:
%System%\sdra64.exe
%Temp%\bot.exe
%Windir%\crypted.exe
Notes:
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  • %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
  • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.