Soon will be out my paper on ZeroAccess.
It's pretty interesting to see that network activity of this rootkit is directed to
IPs that belongs to ISP and Hosting company Ecatel Network strictly linked
with RBN.
ZeroAccess is a well written rootkit, that produces two drivers, one for hiding
( Disk.sys, Atapi, Pci) and another that run PsSetLoadImageNotifyRoutine, used
to infect via APC and ZwAllocateVirtualMemory.
Infection is extremely resistant because via fmifs.dll which stands for Format Manager
for Installable File Systems ; by using FormatEx() you will have the following
\\?\C2CAD972#4079#4fd3#A68D#AD34CC121074
where will be placed all malicious files.
