[Ladik]

Another sample. Packer changed again. Also, this version no longer creates the \??\ACPI#PNP0303#2&da1a3ff&0 symlink, but it creates \??\%08X instead. The number in the format string is retrieved by XORing all four 32-bit values from the MD5 of Systemroot volume creation time. I don't have dropper for it, but it can be installed by running an old ZeroAccess dropper, and replacing infected driver in System32\drivers.

[Alex]

Does M++ infect 64 Bit OS?

http://www.securelist.com/en/blog/493/M ... _platforms

[Xylitol]

Anal_Porn_Movie_162.mpeg.exe ~ 5/43 >> 11.6%
http://www.virustotal.com/file-scan/rep ... 1318344250

ipsec.sys ~ 1/43 >> 2.3%
http://www.virustotal.com/file-scan/rep ... 1318343379

[EP_X0FF]

ZeroAccess sample + infected driver.

For "How To" identify ZeroAccess and do preliminary analysis refer to this Frank's post

Almost statically FUD

http://www.virustotal.com/file-scan/rep ... 1318422204

[Ladik]

New sample. No longer creates a bait service. Symbolic link and protected storage remain unchanged.

[Flopik]

Sample MD5 : 88753E004EF0A8A57D5632613CAC7EFA
They use ntfs ads in service process:

!process 81959B58 0
PROCESS 81959b58 SessionId: 0 Cid: 0314 Peb: 7ffd8000 ParentCid: 02a0
DirBase: 048003c0 ObjectTable: e13281e8 HandleCount: 5.
Image: 3972565216:527906579.exe

lkd> dt _FILE_OBJECT 0x819720e0
+0x030 FileName : _UNICODE_STRING "\WINDOWS\3972565216"

Im wondering why the VAD doesnt have the full name with ADS stream , the information seem only available in usermode from PEB:
lkd> !peb 0x7ffd8000
Base TimeStamp Module
400000 4e3e9782 Aug 07 09:47:46 2011 C:\WINDOWS\3972565216:527906579.exe <----
ImageFile: 'C:\WINDOWS\3972565216:527906579.exe' <------

[EP_X0FF]

Im wondering why the VAD doesnt have the full name with ADS stream

and why it should?

[Flopik]

Any clue how it can be detected in kernel land?

[EP_X0FF]

It is doing so many stuff in kernel mode, so it's not hidden at all. Check objects directory, check threads etc etc, ~one million ways. See 4 posts above for link to example.

[Blaze]

EvilCry,

Is it possible you can post a copy of your Zaccess paper ? It appears the link has been removed.

thanks !