S5Mark VPN (HackTool.Zacinlo) Malware – How to Remove It from Your PC

S5Mark VPN (HackTool.Zacinlo) Malware – How to Remove It from Your PC

This blog post has been created to explain what is the HackToo.Zacinlo malware and show how you can remove it from your PC.

A new malware, calling itself Zacinlo has been recently detected by Symantec researchers to perform series of unwanted activities on the computers of victims. The malware’s main goal is to create various different types of files which monitor the infected computers and the tool registers various different types of entries that allow it to stop system processes and having it on your computer may mean that you may start seeing BSOD (Blue Screen of Death). If your PC has become infected by HackTool.Zacinlo, we advise that you read this article and learn how you can remove HackTool.Zacinlo from your computer completely.

Threat Summary

NameS5Mark VPN and Zacinlo Malware
TypeHacktool Malware/ Rootkit
Short DescriptionHeavily modifies Windows, shuts down system processes and blocks system activities on the infected computers.
SymptomsThe tool begins to monitor your PC and stop processes and if debugger is active, you may see BSOD.
Distribution MethodBundled downloads. Web pages which may advertise it.
Detection Tool See If Your System Has Been Affected by S5Mark VPN and Zacinlo Malware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss S5Mark VPN and Zacinlo Malware.

HackTool.Zacinlo – Spread

In order for this HackTool to be spread onto the computers of victims, the malware may come together with a fake program, like:

  • Fake version or setup of an often used software, like converters, etc.
  • Fake portable versions of programs.
  • Cracks.
  • Patches.
  • Keygens.
  • Other.

In addition to this, the Zacinlo malware, believed to originate from Romanie by the Zacinlo hacking group, has been reported to also add a rootkit compnent and to pretend to be the free VPN service, called s5Mark, which is advertised as an application that is seemingly helpful and provides free VPN services. The app looks like the following:

The app was previouslycategorized as a potentially unwanted programs by malware researchers and now it seems to be used to install Zacinlo malware, which is both a rootkit and a Trojan at the same time.

Zacinlo Malware – Analysis

The distribition of this application and It’s advertisements has been reported to first be active in 2014. The activity then continued in waves in 2015, 2017 and the latest wave is June, 2018.

Once installed on the computer of the victim, the S5Mark VPN program may perform series of malicious activites on the victim PC, with an end goal of installing the malicious component. The S5Mark program itself may remotely connect to a third-party VPN server, the main idea of which is to display various third-party advertisements on the computer of the victim, such as:

  • Pop-ups.
  • Browser redirects.
  • Online banners.
  • Highlighted text advertisements.

Besides the fact that these applications may obtain different information from the victim’s computer, the Zacinlo malware performs series of malicious activites in the background as well. These activities start with modifying the following Windows Registry sub-keys by creating sub-keys in them wit custom values:


The Zacinlo malware then runs a system check up of the following Registry Values:


The check up is done with the goal to filter how programs are opened and with what permissions, which gives the maware control of the executed software on your computers.

The Zacinlo malware then proceeds with it’s malicious activities by checking for the following files to be present in data components of the Windows Registry Editor:


The malware may also blacklist the following .SYS (System) files if they are present somewhere in the Windows Registry Editor:


In addition to this, the Zacinlo malware also performs heavy monitoring of what types of processes are created. If the processes that are created are one of the blacklisted onses, the virus blacklists the certificate and the original file name of the process it does not want to run, until the process has ended, suggesting that this hacktool is the work of someone with quite the experience with Windows systems.

But the Zacinlo malware may also shut down processes automatically. Researchers have reported it to target and delete any registry entries of the infected computer that may belong to the following .EXE processes:

.EXE Processes Stopped by Zacinlo Malware in the Windows Registry Editor

The malware creates a threat which checks whether or not the Windows 10 debugger is active.

Remove HackTool Zacinlo from Your Computer Completely

The Zacinlo malware can be removed manually if you follow the manual removal instructions below. But since they are general methods and approach on how to remove viruses such as Zacinlo, complications may occur if you try to remove Zacinlo yourself, because one wrong file that is deleted may make the difference between breaking your Windows and stopping it from functioning and deleting the virus completely. This is why, for maximum effectiveness, security professionals often advise turning to an advanced anti-malware software and taking the automatic removal approach. Such software will automatically scan your computer for the Zacinlo malware and remove it from your computer completely, plus ensure that your PC stays protected agianst future infection as well.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share