ZeroAccess rootkit launched by signed installers