PTCH_ZACCESS.A

October 09, 2012
 Analysis by: Rhena Inocencio
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet, Dropped by other malware


This is the Trend Micro detection for files patched with malicious code by ZEROACCESS malware family. It is then used as an autostart malware component. Once the normal file is loaded, it executes a copy of the main malware.

  TECHNICAL DETAILS

File Size:

259,072 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

29 Jun 2012

NOTES:

This is the Trend Micro detection for files patched with malicious code by ZEROACCESS malware family. It is then used as an autostart malware component. Once the normal file is loaded, it executes a copy of the main malware.

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

9.224.07

FIRST VSAPI PATTERN DATE:

29 Jun 2012

VSAPI OPR PATTERN File:

9.225.00

VSAPI OPR PATTERN Date:

30 Jun 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restore a file/s that has/have been corrupted/modified by this malware/grayware

To restore system files:

• For Windows 2000:

  1. Insert your Windows 2000 Installation CD in your CD-ROM drive.
  2. Click Start>Run.
  3. In the Open text box, type the following then click OK:
    expand D:\i386\{file to restore}.ex_ %windir%\system32\{file to restore}.exe

    4. (Note: In the example above, D: refers to the CD-ROM drive. If your CD-ROM drive is not D:, please change the letter accordingly. Also, the file to restore is C:\WINNT\System32\explorer.exe.)

• For Windows XP and Windows Server 2003:

  1. Click Start>Run.
  2. In the Open text box, type the following then click OK:
    MSCONFIG

  3. Make sure that the option Normal startup - load all device drivers and services option is selected.

  4. Click the Expand button.
  5. In the dialog box that appears, type the following:

    6. Wherein:
    • File to restore contains the path and file name of the file you wish to restore.
    • Restore from contains the path to the Windows CAB files. This path may vary from machine to machine. It may be in a local drive, in a network drive, or in a CD-ROM. In the local drive, it is usually in C:\WINDOWS\OPTIONS\INSTALL.
    • Save file in contains the path of the file you wish to restore (Do not include the file name).
  6. Click the Expand button.

Step 3

Scan your computer with your Trend Micro product to delete files detected as PTCH_ZACCESS.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:

For Windows Vista and 7, users may also use the System File Checker (SFC) to restore modified files using the following steps:

  1. Run CMD as administrator. Right click on cmd > Run as admin.
  2. Type the following on the command prompt and press Enter:
    sfc /scanfile=c:\windows\system32\services.exe

More information on using System File Checker to repair missing or corrupted system files in Windows are found in the following Microsoft pages:


Did this description help? Tell us how we did.