ECSYN.DLL is Rootkit ZeroAccess

June 27, 2012 by NightWatcher
Filed under: Rootkit 
: Solved!

Fix it immediately:

Rootkit ECSYN.DLL is software that enables continued privileged access to a computer while actively hiding its presence.
Detection and removal of ECSYN.DLL may be a very difficult process.
You should use anti-rootkit software to fix the ECSYN.DLL problem.

Malware Analysis of ECSYN.DLL
Full path on a computer: %Appdata%\ecsyn.dll

Detected by RegRun Warrior:

ECSYN.DLL
Default location: %Appdata%\ecsyn.dll

Removal Results: Success
Number of reboot: 1

ECSYN.DLL is known as:

Rootkit.ZeroAccess

ECSYN.DLL hash:

  • MD5: 7bd341a81c9e86ba3b37fc43c3c665ce
The file tries to download information from some web sites.
How to quickly detect ECSYN.DLL presence?

Registry:
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ecsyn: “rundll32.exe “%Appdata%\ecsyn.dll”,IVoidPtrList_CreateInstance”
Folders:
  • %WinDir%\$NtUninstallKB62478$
Files:
  • %Appdata%\ecsyn.dll


  • Recommended: UnHackMe anti-rootkit and anti-malware

    Premium software: RegRun Security Suite (Good choice for removal and protection)

    Written by

    Malware Hunter.

    Tags: ECSYN.DLL, Rootkit, ZeroAccess

    Comments

    Tell me what you're thinking...
    and oh, if you want a pic to show with your comment, go get a gravatar!

    You must be logged in to post a comment.