Home Malware Programs Trojans Trojan.Zeroaccess!gen4

Trojan.Zeroaccess!gen4

Posted: January 30, 2012

Threat Metric

Ranking: 10,358
Threat Level: 2/10
Infected PCs: 70,158
First Seen: January 30, 2012
Last Seen: September 8, 2023
OS(es) Affected: Windows

Trojan.Zeroaccess!gen4 is a malicious Trojan that allows attackers to gain remote access and control over the targeted computer system. A huge variety of payloads are related to Trojan.Zeroaccess!gen4. Trojan.Zeroaccess!gen4 is also a heuristic detection based on weird behaviors presented by objects given as system files. If the detection is not a false positive, the files are identified as system hooks used to hide Trojan.Zeroaccess!gen4 and corrupt the compromised PC. Trojan.Zeroaccess!gen4 can be used to drop multiple malware threats such as fake security software, involve infected PC system into botnets, use its IP for malicious actions and record keystrokes. Remove Trojan.Zeroaccess!gen4 before it harms your machine.

Aliases

W32/ZAccess.G!tr.rkit [Fortinet]Rootkit.Win32.ZAccess [Ikarus]Win32/ZAccess.J!generic [eTrust-Vet]TR/Rootkit.Gen [AntiVir]Gen:Rootkit.Heur.euY@giFJlOh [BitDefender]Trojan.Zeroaccess!gen4 [Symantec]

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%WINDIR%\System32\drivers\ipsec.sys File name: ipsec.sys
Size: 75.26 KB (75264 bytes)
MD5: 1b42118411183aa9e13aff2b32688d02
Detection count: 7
File type: System file
Mime Type: unknown/sys
Path: %WINDIR%\System32\drivers
Group: Malware file
Last Updated: February 2, 2012
[RANDOM CHARACTERS].exe File name: [RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{89721a77-988b-43cb-81e4-89c101e44f15}InprocServer32

Additional Information

The following URL's were detected:
sinewedretore.casa
Loading...