ZeroAccess Authors Are Now Faking Company Name: Oak Technology Inc.

First, I should mention that, Oak Technology Inc is a legitimate company that designs, develops, and markets high-performance multimedia semiconductors and related software to original equipment manufacturers worldwide who serve the multimedia PC, digital video consumer electronics, and digital office equipment markets. For more information, read here: Wiki

Similar to how many malware authors fake the company name: Microsoft Corporation, to avoid detection and removal of their files, services, and drivers, it seems now the authors behind ZeroAccess are going for a more subtle approach with Oak Technology Inc.

The latest ZeroAccess infections which MBAM labels RootKit.0Access.H include a malicious .DLL file in the C:\WINDOWS\system32 directory. For example:  C:\WINDOWS\system32\downloadmanagerlite.dll

MalwareBytes's Anti-Malware seems to be on top of this but one thing it neglects is the ability to find and remove the bad NetSvcs (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost|netsvcs) data value associated with this .DLL

For example, this was taken from an OTL log (Old Timer's List It) with this new variant of ZeroAccess:

NetSvcs: ksthunk - C:\WINDOWS\system32\downloadmanagerlite.dll (Oak Technology Inc.)

So as you can see, not only is there a bad .DLL file in system32 (downloadmanagerlite.dll), but it is also tied into a bad NetSvcs data value (ksthunk).

That's not the end of it though. There is also a bad service, usually with the same name as the NetSvcs data value.

The below was also taken from an OTL log:

SRV - [2008/04/13 17.14.22 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto | Running] -- C:\WINDOWS\system32\downloadmanagerlite.dll -- (ksthunk)

This service (ksthunk) is also problematic and needs to be stopped and deleted.

To ensure complete removal, all three components need to be deleted.

Symptoms include:
High CPU usage
"Wild ping" which I assume means ping.exe is constantly being used.

Just providing some examples from what others have mentioned

With this rootkit constantly being improved, expect other legitimate company names to be used.

Just something to look out for :-)


=========================================
Edit: MBAM can now find and delete NetSvcs data values!
=========================================

Just saw the below in one of the threads I am currently working on:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost|netsvc (TrojanProxy.Agent) -> Data: SPService^n^ -> Quarantined and deleted successfully.