Mal/EncPk-ALC

Posted: August 1, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	12,338
Threat Level:	2/10
Infected PCs:	1,871

First Seen:	August 1, 2013
Last Seen:	October 10, 2023
OS(es) Affected:	Windows

Mal/EncPk-ALC is a malicious component of one of the latest variants of ZeroAccess (AKA Sirefef), a sophisticated backdoor Trojan that's heavily associated with the Bitcoin mining operations and click fraud. The new additions made to Mal/EncPk-ALC Trojans appear to be for the purpose of concealing its attacks and making Mal/EncPk-ALC even more difficult to remove, with file path obfuscation exploits and file access permission controls being abused to block you from removing Mal/EncPk-ALC easily. SpywareRemove.com malware researchers have classified all variants of ZeroAccess as high-level threats, and Mal/EncPk-ALC should be considered likewise before Mal/EncPk-ALC's deletion by appropriately-advanced anti-malware tools.

Mal/EncPk-ALC: the Extra Software Surprise that's Hidden Inside

Mal/EncPk-ALC and other ZeroAccess variants are often distributed by fake or compromised installers for pirated software utilities, such as key generators or popular game cracks. As a package that's one of the first files you'll encounter in this variant of ZeroAccess, Mal/EncPk-ALC employs encryption to obscure its malicious payload, along with several techniques designed to hide the additional components of the ZeroAccess infection. SpywareRemove.com malware experts consider the most notable of these to be the abuse of unprintable Unicode characters (such as the right-to-left override) to keep PC users from accessing the locations of Mal/EncPk-ALC's hidden ZeroAccess files. However, even if you can access the correct folder, Mal/EncPk-ALC also implements a basic Access Control List-based defense that will prevent you from modifying the malicious files regardless of all else. Any PC users interested in browsing their Registries also will find additional components of Mal/EncPk-ALC's infection that are mislabeled as Google Update entries.

These ineresting new defenses make up the bulk of Mal/EncPk-ALC's changes to ZeroAccess, but ZeroAccess's primary attacks still are the same as always. SpywareRemove.com malware researchers are obligated to warn that any PC compromised by Mal/EncPk-ALC is in danger of attacks such as:

Click fraud activities that use your PC's resources to generate fraudulent 'clicks' for revenue.
Bitcoin mining, a similarly-concealed function for generating illegal currency that has the unfortunate side effect of damaging the compromised PC's hardware through the overuse of its system resources.
Mal/EncPk-ALC also may hijack your search results and insert irrelevant or malicious links.
Perhaps the most significant feature of Mal/EncPk-ALC's payload is its ability to disable and block various Windows security programs, including the firewall, Windows Defender and Windows Security Center.

Taking Away Mal/EncPk-ALC's Much-Abused Access to Your Computer

Mal/EncPk-ALC and all other variants of ZeroAccess are high-level PC threats that should be treated with the highest level of caution by removing them immediately with reliable anti-malware software. Although the majority of Mal/EncPk-ALC and other ZeroAccess functions don't show many obvious symptoms, noticing Mal/EncPk-ALC may be feasible through a close monitoring of your PC's stability, performance and resources expenditures. Unusual CPU usage, in particular, often is a sign of the Bitcoin mining and click fraud attacks that Mal/EncPk-ALC is known for using.

However, staying clear of ways of getting your PC infected with Mal/EncPk-ALC is much safer than using even the best anti-malware program to delete Mal/EncPk-ALC after the infection already has occurred. Once again, SpywareRemove.com malware experts must emphasize that avoiding downloads from suspicious sources – and especially illegal software – is a lynchpin to keeping your PC safe from modern PC threats like Mal/EncPk-ALC.

Technical Details

Additional Information

The following URL's were detected:

scontaneous.website