Threat Search: 

ThreatExpert's Statistics for Troj/Zbot-BS [Sophos]:

Troj/Zbot-BS [Sophos] is also known as:
Threat AliasNumber of Incidents
Trojan.Win32.Zbot [Ikarus]10
Trojan-Spy.Win32.Zbot [Ikarus]6
Spy-Agent.dp.gen [McAfee]4
Trojan.Win32.Agent2.afs [Kaspersky Lab]4
Infostealer.Banker.C [Symantec]2
Packed.Generic.196 [Symantec]2
Backdoor.Graybird [Symantec]1
Generic.dx [McAfee]1
Trojan-Spy.Win32.Zbot.qka [Kaspersky Lab]1

Troj/Zbot-BS [Sophos] is known to be created as:
%System%\ntos.exe
%Windir%\9129837.exe
Notes:
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.