https://www.botnets.fr/index.php?action=history&feed=atom&title=ZeroAccess%3A_code_injection_chroniclesZeroAccess: code injection chronicles - Revision history2026-10-24T00:38:40ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=ZeroAccess:_code_injection_chronicles&diff=2314&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:27:02Z<p>1 revision imported</p>
<p><b>New page</b></p><div>{{Publication<br />
|Image=ZeroAccess_code_injection_chronicles.png<br />
|Legend=<br />
|Document=<br />
|Licence=<br />
|Video=<br />
|Link=http://blog.eset.com/2012/06/25/zeroaccess-code-injection-chronicles blog.eset.com<br />
|Author=Aleksandr Matrosov, <br />
|NomRevue=ESET Threat Blog<br />
|Date=June 26, 2012<br />
|Editor=ESET<br />
|Year=2012<br />
|ISBN=<br />
|Page=<br />
|Abstract=At the end of spring 2012, the rootkit family Win32/Sirefef and Win64/Sirefef (also known as ZeroAccess) was updated. We start tracking the first updated samples at the beginning of May when a new affiliation program started for the distribution of a new ZeroAccess version. The updated version of Sirefef doesn't use kernel-mode drivers, as was done previously, and doesn’t have hidden file storage. The affiliation program substitutes its own choices for the results of popular search engines as a means of monetization.<br />
|Botnet=ZeroAccess, <br />
|Malware=ZeroAccess_(bot), <br />
|CCProtocol=, <br />
|Operation=, <br />
|Keyword=, <br />
}}</div>Eric.freyssinet