Threat Spotlight: Trojan.
Zeroaccess
Trojan.Zeroaccess is a Trojan horse that uses an advanced rootkit to hide itself. It is often installed through drive-by-download attacks from sites hosting the Blackhole exploit kit. The Trojan can also create an encrypted, hidden file system, download more malware, and open a back door on the compromised computer.
The Trojan is called ZeroAccess due to a string found in the kernel driver code that is pointing to the original project folder called ZeroAccess. It is also known as max++ as it creates a new kernel device object called __max++>.
More information on Trojan.Zeroaccess is available in the threat family writeup.
Risk
Threat
Vulnerability
With the rapid rise in the number of malware attacks it’s harder than ever to prevent machines from getting infected. But have you done everything you can do? Have you done the things you must do to stay protected? Following some simple best practices can make a tremendous difference in improving your protection. Symantec has assembled a set of best practices for today’s threat landscape.
With more than 800 million registered accounts, Facebook is the largest social network in use at the moment. Consequently, it is also becoming a booming attack ground for malware authors and scammers. Most of the attacks that we currently see use social engineering tricks to spread their messages to thousands of users.
