Hi Norton Community,
The below FAQs tries to answer some common questions regarding the GameOver Zeus threat and the role Norton products play in defending you against this threat.
1. What is GameOver Zeus threat?
GameOver Zeus (GOZ) is a variant of Trojan.Zbot, often known as 'Zeus', and uses a peer-to-peer network and domain generation algorithm (DGA) for command and control. For more information, read the announcement from US-CERT.
2. What does GameOver Zeus do?
The GameOver Zeus botnet can be used to facilitate financial fraud on a large scale by hijacking thousands of victims' online banking sessions. GameOver Zeus is typically distributed through an email which poses as an invoice. Once an infected user visits their banking website from a compromised computer, GameOver intercepts their online session using a technique commonly known as man-in-the-browser (MITB). It can bypass two factor authentication and display fraudulent banking security messages to the user to obtain information for transaction authorization. As soon as the attackers get these details, they can modify the users' banking transactions and steal their money.
3. How does Norton protect me?
All Norton security products (including Norton AntiVirus, Norton Internet Security, Norton 360, and Norton Security Suite) incorporate multiple layers of defense against malicious software like GameOver Zeus. However, these threats constantly change to try and evade detection.
If your computer becomes infected, perhaps due to a new variant or because you do not have an active Norton subscription, the threat itself is very difficult to detect. If you think your computer is infected with GameOver Zeus virus, then use the Norton custom removal tool to check your computer. This tool is designed to by pass the rootkit evasion techniques of the threat itself and removes it. This removal tool is important because the GameOver Zeus variant blocks any attempt to install Norton products.
For detailed instructions on downloading and using the removal tool, read Trojan.Zbot Removal Tool.
Knowledge Base Article: Information on Norton products and the GameOver Zeus threat
Symantec Security Response Blog: International Takedown Wounds Gameover Zeus Cybercrime Network
Thanks,
Sunil G A
Norton Forums Administrator
Symantec Corporation