ZoneAlarm Free and the ZeuS.Zbot.aoaq

This is not a new infection nor is it something that we have seen ZoneAlarm block nor have they removed it. Neither has any other tool completely. Typically it has required manual interverntion. A couple of the common files seen were any of oembios.exe; ntos.exe; sdra64.exe; twex.exe; twext.exe being run on top of userinit.exe on boot up. You can search on ntos.exe and see that it has been around for quite awhile ( at least since 2007 ).

However Kaspersky did later create a program named ZbotKiller in an attempt to remove this. You can see info on it here:

http://support.kaspersky.com/faq/?qid=208280039

Note sure of how effective it was/is.

Oh and by the way, just to show that Zonealarm did not fix this malware, their own website even posted the info to use Kaspersky's ZbotKiller: http://www.zonealarm.com/security/en-us/av-resources/zbotkiller.htm

And in fact Kaspersky is the actual engine that Zonealarm uses in their program.

Yes this was quite a bad idea on their part and they tried to cover it up later with some hand waving, but this only served to hurt their reputation significantly since they were behaving like a rogue tool and trying to trick you into buying their software.

 

You're welcome. Surf safely!