For Home

Virus Profile: ZeroAccess.eq

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 6/12/2012
Date Added: 6/12/2012
Origin: N/A
Length: Varies
Type: Trojan
Subtype: Rootkit
DAT Required: 6812
Removal Instructions
   
 
 
   

Description

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases :

  • Symantec           -    Trojan.Zeroaccess!gen7
  • NOD32             -    Win32/Sirefef.EV
  • Kaspersky         -    Backdoor.Win32.ZAccess.tjg
  • Microsoft         -    Trojan:Win32/Sirefef.P

Indication of Infection

  • Presence of above mentioned files and registry activities.
  • Presence of above mentioned network connections.

Methods of Infection

  • Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.
   

Virus Characteristics

“ZeroAccess.eq” is detection for this Trojan that uses an advanced rootkit to hide itself. It is often installed through drive-by-download attacks from malicious web sites.

Upon execution the Trojan connects to the below IP Address 

  •       210.83.[Removed].190
  •       61.160.[Removed].205
  •      195.189.[Removed].224

And makes a connection to the following URL’s

  • Onefo[Removed]th.com ; (Port: 80)
  • ck.dd[Removed].net ; (Port: 88)
  • 2wrm[Removed].com ; (Port: 520)

The Trojan creates the following files into the below location

  • %appdata%\114shy.bat
  • %appdata%\a8frfra.exe
  • %appdata%\q2yd.exe
  • %alluesrsprofile%\svchost.exe
  • %windir%\system32\ap0wgcv9.dll
  • temp\s29.tmp
  • temp\VRT26.tmp
  • temp\VRT27.tmp
  • temp\VRT28.tmp

The following registry key has been added:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetDriver
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Security
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\Security
  • HKEY_USER\.DEFAULT\Software\Classes\CLSID
  • HKEY_USER\.DEFAULT\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}
  • HKEY_USER\.DEFAULT\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32

The following registry values has been added

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ipiote: 0x01010307
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lumj = "%appdata%\q2yd.exe"

The above mentioned registry values ensures that the Trojan gets executed whenever the System starts.

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetDriver\AppPath: "%appdata%\q2yd.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetDriver\AppFolderPath: "%appdata%\"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetDriver\AppName: "q2yd"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Type: 0x00000110
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Start: 0x00000002
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\ErrorControl: 0x00000000
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\ImagePath: "%appdata%\114shy.bat"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\DisplayName: "q2yd"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\ObjectName: "LocalSystem"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Description: "Enables a computer to use mouse from USB port. Stopping or disabling this service will result in system instability."
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\??\%WINDIR%\system32\winlogon.exe: "\??\%WINDIR%\system32\winlogon.exe:*:enabled:@shell32.dll,-1"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\??\%WINDIR%\system32\winlogon.exe: "\??\%WINDIR%\system32\winlogon.exe:*:enabled:@shell32.dll,-1"

Above entries confirms the Trojan creates firewall policies for the dropped files.

  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Type: 0x00000110
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Start: 0x00000002
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\ErrorControl: 0x00000000
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\ImagePath: "%appdata%\114shy.bat"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\DisplayName: "q2yd"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\ObjectName: "LocalSystem"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\q2yd\Description: "Enables a computer to use mouse from USB port. Stopping or disabling this service will result in system instability."
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\Type: 0x00000110
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\Start: 0x00000002
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\ErrorControl: 0x00000000
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\ImagePath: "%appdata%\114shy.bat"
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\DisplayName: "q2yd"
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\ObjectName: "LocalSystem"
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\q2yd\Description: "Enables a computer to use mouse from USB port. Stopping or disabling this service will result in system instability."

Above entries confirms the Trojan creates services for the dropped files.

  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE: "yes"
  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error: "no"
  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags: 0x00000000
  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Internet Explorer\Main\FullScreen: "no"
  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Internet Explorer\Main\SearchMigrated: 0x00000000

Above entries confirms the Trojan changes IE settings.

  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Windows\CurrentVersion\Explorer\UpdateHost: 00 50 72 70 FF 51
  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden: 0x00000002
  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden: 0x00000000
  • HKEY_USER\S-1-5-[VARIES]\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden: 0x00000001

Above entries confirms the Trojan hides files from users.

And the below registry values has been modified to the system:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = ""%programfiles%\Common Files\Java\Java Update\jusched.exe""
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "%alluesrsprofile%\svchost.exe"
   

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).