View source for The ZeroAccess rootkit

{{Publication
|Link=http://www.sophos.com/en-us/why-sophos/our-people/technical-papers/zeroaccess.aspx www.sophos.com
|Author=James Wyke
|NomRevue=Sophos Lab UK Whitepaper
|Editor=Sophos
|Year=2012
|Botnet=ZeroAccess
|Malware=ZeroAccess (bot)
|CCProtocol=DGA
|Abstract=ZeroAccess is a sophisticated kernel-mode rootkit that is rapidly becoming one of the 
most widespread threats in the current malware ecosystem. ZeroAccess’ ability to run on both 
32-bit and 64-bit versions of Windows, resilient peer-to-peer command and control infrastructure
and constant updates to its functionality over time show that ZeroAccess is a modern threat 
capable of thriving on modern networks and modern Operating Systems.
In this paper we will explore the ZeroAccess threat; from the distribution mechanisms 
used to spread it, through the installation procedure, memory residence and payload. We 
examine how ZeroAccess works and what its ultimate goal is.
}}