Win32:ZAccess-TL [Trj] information

The Win32:ZAccess-TL [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:ZAccess-TL [Trj] virus can do?

• Sample contains Overlay data
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32:ZAccess-TL [Trj]?

File Info:
name: E073DA1CDD0A21B1E38E.mlw
path: /opt/CAPEv2/storage/binaries/e0694413df75308f4f985df320fbd863cdc0022a0c563fe7f934d032a972e04b
crc32: ACA5C3A2
md5: e073da1cdd0a21b1e38e87cd1fac7edb
sha1: 5cd1aabfab6763131ad061c8179fffb7a327e3aa
sha256: e0694413df75308f4f985df320fbd863cdc0022a0c563fe7f934d032a972e04b
sha512: 569d39a4914b4b4ebbea51743f184542eee89e8058f4321a09f6e7ada24df549c3dc5859872f062f5bd8ceacefde9ed6cce7860726149a7c89165ef91034473d
ssdeep: 98304:9K1kCoo7UVIt9gAsSeH6kvHS8TPPpf5OpkZPp0prJdNLU6D:9a9j9g8e/FN5O6FQJDLZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19856127323694580D0E98C318537BDE175F3036D8B82A87948B7B9CAF5F68A5FE52903
sha3_384: 9dd72b0b900324bf181156379bd5ac87ed615241070daadc3d1e9655b9bab6edf30f900f74fc1e0f8b4b27f8a105b2cf
ep_bytes: 008a020008cfd521efbc68de4f26e371
timestamp: 2013-08-31 06:06:17

Version Info:
CompanyName: Корпорация  М айкрософт
FileDescription: Диспетчер синхронизации
FileVersion: 5.1.2600.5512 (xpsp.080413-2108)
Translation: 0x0419 0x04b0

Win32:ZAccess-TL [Trj] also known as:

How to remove Win32:ZAccess-TL [Trj]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.