[Quads]

OK Roguekiller finds the Install folder on a 32bit system located C:\Program Files\Google\Desktop\Install

But doesn't find the Install folder if located in C:\Program Files (x86)\Google\Desktop\Install

I created the C:\Program Files (x86)\Google\Desktop\Install path and folders on my system and Roguekiller does not find it

Roguekiller does find these 2 locations, I created these 2 paths and folders also

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][Folder] Install : C:\Users\Quads\AppData\Local\Google\Desktop\Install [-] --> FOUND
[ZeroAccess][Folder] Install : C:\Program Files\Google\Desktop\Install [-] --> FOUND


Quads

[0x16/7ton]

Dropper from 01.09.2013 with mini-update

01_09_2013.rar

pass: infected
(100.68 KiB) Downloaded 97 times

Sirefef attempts to stop and delete in addition two services: RemoteAccess,PolicyAgent

mini_update.png (11.12 KiB) Viewed 941 times

[Win32:Virut]

60 droppers

03.09.2013 - 07.09.2013

[Cody Johnston]

ZeroAccess C&C / Dropzone

http://dnsamplificationattacks.blogspot ... -page.html

[rough_spear]

Hi All,

one more sample of Sirefef.

MD5 - 456D4D94B65C44C8B42901F2D87538A6

VT link - https://www.virustotal.com/en/file/0853 ... /analysis/

Regards,

rough_spear. ;)

[Win32:Virut]

48 droppers

08.09.2013 - 14.09.2013

[Win32:Virut]

41 droppers

14.09.2013 - 21.09.2013

[r3shl4k1sh]

A paper by Symantec called ZeroAcess Indepth
It seems they went really depth in some areas...

[EP_X0FF]

Blah-blah-blah with hyped marketing shit in the end, completely wrong timeline and major copy-paste work from Sophos articles. Not to mention they totally miss 2013 versions.

[N3mes1s]

and not only one mismatch

https://twitter.com/threatintel/status/ ... 8244063232