W32/Zlob.CCS is a Trojan that will infect Windows systems.

The Trojan may be dropped by other malware or may be downloaded from remote website by other malware. It may also be downloaded unknowingly by a user while visiting malicious Web site.

Upon execution, the Trojan copies itself as (Random file name).exe in Windows System folder.

The Trojan modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

It also modifies registry at the following location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion

The Trojan also checks if the user has visited certain web sites in its predefined list, which are mostly adult-themed. It terminates itself if it finds a match.

It also attempts to connect to http://(BLOCKED).50.(BLOCKED).24/gather.php

More information can be found at this Proland Software page.