Rootkit:W32/ZAccess

Threat description

Details

CATEGORYMalware
TYPETrojan

Summary

Rootkit:W32/ZAccess constantly displays advertisements on the infected machine and may silently contact remote servers to retrieve additional advertising information.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

Manual action

Perform a full scan of the computer system with the F-Secure security product to find and disinfect the relevant files. Before scanning, enable the product to scan system files by following these steps:

  • In the F-Secure product, go to "Settings"
  • Go to "Manual scanning"
  • Uncheck "Scan only known file types"

Then perform a full computer scan.

If you suspect that a file contains harmful code, or that a program is performing harmful actions, you can send a sample of it to F-Secure Labs for analysis:

You may also refer to the following articles for more information:

Or Contact Support for further assistance.

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Contact Support

F-Secure customers may request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Rootkit:W32/ZAccess is distributed in programs disguised as a cracked copies of legitimate commercial software (a distribution method more commonly seen with trojans). It may be distributed via pornography websites. It has also been reported as being distributed via compromised legitimate websites.

Once installed, ZAccess will display unsolicited advertisments on the machine and redirects the web browser to unsolicited advertisement websites. In order to do the latter, the malware may contact remote servers to retrieve additional advertising information; the specific URLs contacted are varied, but the top level domain is always .CN.

Installation

On installation, the malware will replace a system driver (in the location %WINDIR%\system32\drivers) with a copy of its rootkit driver. Selection of a system driver to replace is done using an internal algorithm. The rootkit will display the contents of the original system driver, presumably to camouflage its presence on the system.

The malware then creates a hidden, encrypted volume which is used to store the original system driver file that was replaced, as well as other component files used by the malware. The hidden volume has the following format:

  • %WINDIR%\$NtUninstallKB{5_digits}$

It also creates a zero byte Alternate Data Stream file in %WINDIR%\{numbers_only_file} which will be silently executed and run in the background:

Some variants of this malware will drop other component files in the following location:

  • %USERPROFILE%\Local Settings\Application Data\number_only_folder

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info