It is well known that Trojan.Zbot was created by the ZeuS tool kit, and recently it has added the ability to infect files to its bag of tricks. A recently discovered Trojan.Zbot variant searches for executable files in a predefined place and injects the executable files it finds with 512 bytes of code. It then modifies that program's entry point so that it is at the top of the injected code. The injected code is very simple and performs the following actions: