View source for ZeroAccess anti-debug uses debugger

{{Publication
|Type=Blogpost
|Link=http://blog.malwarebytes.org/intelligence/2013/07/zeroaccess-anti-debug-uses-debugger/
|Author=Joshua Cannell
|NomRevue=Malwarebytes unpacked
|Date=2013-07-25
|Editor=Malwarebytes
|Year=2013
|Botnet=ZeroAccess
|Abstract=The technique employs various native Win32 APIs used for debugging a process. By using these APIs, the analyst cannot use their own debugger, since only one debugger can be attached to a process at a time.

To connect to the debugger at the API level, the Trojan uses DbgUIConnectToDbg. This API along with others used to communicate with the Windows Debugger all seem to be undocumented by Microsoft.
}}