ZeroAccess, an advanced kernel mode rootkit

Triple Helix · Apr 11, 2011

ZeroAccess, an advanced kernel mode rootkit

In the last couple years there have been three major players who dominated the scene in the field of the kernel mode rootkit development. They are Rustock rootkit - with its latest build discovered in the wild in 2008 - MBR rootkit - firstly discovered in January 2007 - and TDL rootkit, which can be considered the most advanced kernel mode rootkit to date, able to infect both x86 and x64 versions of Windows operating system.
In mid 2009 another player quietly started targetting Windows and its kernel, slowly becoming more than "yet another rootkit". ZeroAccess rootkit, also known as Max++ rootkit, showed since its beginning a very good code development and interesting features, like exploiting the NTFS file system's feature called junction (a folder symbolic link actually) to create fake folders able to kill most security software when they tried to get access to such folders.
Click to expand...

Full Story:
http://www.prevx.com/blog/171/ZeroAccess-an-advanced-kernel-mode-rootkit.html

CloneRanger · Apr 11, 2011

@ Triple Helix

Thanks for posting, i don't pretend to understand most of the nitty gritty though !

Some of these RK coders are very smart people, pity they don't use their $kill$ in non criminal areas.

This rootkit was storing its code in two alternate data streams
Click to expand...

ADS a place where most don't look NTFS = ADS = no thanks, i like FAT32

Before overwriting the driver’s body, the dropper makes sure to suspend the System File Checker (SFC) thread by suspending all threads related to the sfc_os.dll module. These threads are resumed after the infection routine is finished.
Click to expand...

Clever & very effective

No mention of how this & similar could be prevented though, via AntiExe's & HIPS etc.

Log in or Sign up

ZeroAccess, an advanced kernel mode rootkit

Triple Helix Specialist

CloneRanger Registered Member

Log in or Sign up

ZeroAccess, an advanced kernel mode rootkit

Triple Helix Specialist

CloneRanger Registered Member

Useful Searches