ZeroAccess – the movie

Posted on January 1, 2012 by Chad Loeven

   

Back in October we blogged about the recently uncovered (at the time) ZeroAccess kernel-mode rootkit and published some screenshots of how an infected machine looked when analysed by ECAT. We’ve gone back this time for another look at ZeroAccess and drilled down in more detail with this 4 minute video. We show step-by-step how the rootkit compromised the machine and how and why ECAT raised the suspect level on each compromised or injected component found.

 

We’ll be following up in future posts with more analyses using ECAT and posting videos on our Youtube channel that you can subscribe to here.

For a whitepaper on ECAT or to request more information, please click here