Nerds on Computers: Update security software to defend yourself against latest rootkit virus

The Trojan.Zeroaccess is the latest rootkit virus to infiltrate a huge number of computers, infecting nearly 1 million systems worldwide, according to James Wyke, senior threat researcher for SophosLabs.

While traditional viruses attempt to infect and destroy as many computers as possible before they're stopped by anti-virus software, rootkits aim to keep a system working but put it under the control of an outside party. They typically give administrative power to a remote user, who can take control of the system and manipulate files.

Once the rootkit administrator takes control, he can execute actions. Your system becomes a "botnet," or "zombie" computer, assisting the culprits in performing fraudulent acts, downloading additional malware and opening software back doors for hackers to enter. Because rootkits execute at the same privilege level as anti-malware software, they're harder to remove — your computer can't decide which program should have greater authority to shut down the other.

According to Wyke, the ZeroAccess rootkit Trojan and its nine known variants have been installed more than 9 million times. The resulting "botnet" comprises approximately 1 million zombie machines, generating huge profits for their masters.

In his technical paper, "The Zero Access Botnet — Mining and Fraud for Massive Financial Gain," Wyke calls ZeroAccess "one of the biggest threats on the Internet."

This virus spreads in two primary ways. The first is through a Blackhole exploit kit: Through a compromised website or a spammed email, the victim is directed to the hacker's landing page. Ad servers are prime targets for this type of corruption because their high traffic leads to widespread infection. The bad Web page contains a JavaScript that scans your computer for vulnerabilities. If they're found, the virus silently downloads into the background workings of the computer and begins to take over.

The second method of distribution is through social engineering. The victim is convinced to run an executable file because he is attempting to obtain a piece of illicit software, bypass copyright protections, etc. For example, one lure the ZeroAccess creators have used is an illegal copy of a popular game called Skyrim. The user attempts to download it, is prompted to open a zip file and the virus is installed, essentially with the user's permission.

Initially, victims notice that computer processing slows to a crawl. Internet searches are redirected to unrelated site and pop-ups appear much more frequently during Web browsing. Advanced forms of the virus have been linked to information mining and financial fraud, with hackers gaining access to personal information and performing identity theft.

According to Sophos-Lab's research, hackers will pay up to $500 for every 1,000 infected U.S. systems that a rootkit administrator can prove they've added to their botnet.

Defend yourself before you're infected. Make sure all your browsers, plug-ins and operating systems are updated with the latest version of software. Out-of-date Firefox, Internet Explorer and Google Chrome — in addition to Adobe Flash, Acrobat and Java — are prime targets of Blackhole exploit kits.

Don't give in to the temptation of downloading illegal software through sharing and torrent sites. Keep your anti-malware software current and run it often. Regular backups of your data and applications will allow you to more easily perform a reformat/reinstall of your operating system if your computer becomes infected and you are unable to remove the virus through conventional methods.

If you suspect your computer may be infected, contact a computer repair professional as quickly as possible. Not only does this virus open doors for other malware to enter your system undetected, but it's extremely difficult to remove. It is known to leave behind portions of itself and continue to haunt your computer if not removed properly.


Subscribe to the Redding Record Searchlight

Game of the Week Contest
Email Signup for Newsletters

Click here to see an example newsletter

Sign up for our apps
Download our apps