Spotlight on Malware: ZeroAccess Rootkit.

Today's blog post will be about a piece of malware that is considered by many computer security professionals to be one of the worst pieces of malware. This malware is called the ZeroAccess rootkit, although I have given it the nickname "The Devil's malware."

From what it does, some controversy is generated on what kind of malware it should be classified as. It is used to download other malware onto the infected machine and to form a botnet that is mostly used for Bitcoin Mining and Click Fraud. It does this by concealing itself by using techniques commonly used by rootkits. It also can be downloaded by users because it may claim to be something else, which fits into the description of Trojans.

So, it can be classified as a Trojan, a Botnet, or a Rootkit. I prefer to call it a rootkit, but you can call it whichever one you would like as all of these are correct classifications. And it should be noted that this malware also steals passwords which you enter into your computer.

This piece of malware is considered so dangerous because of the fact that it replaces critical system files with it's own. This makes proper removal a challenge for even the most skilled removal professional due to the fact that removal requires the use of specialized tools in a very specific way. This is made more difficult by the fact that one way of removing one variant likely will not work correctly for another.

Despite all the advances made against malware in recent years, it is not possible to ever consider a computer infected with ZeroAccess to ever be safe again. This is even after removal, leaving the only surefire path to computer security a option that is usually employed only after everything else has failed: Reinstalling the operating system. The operating system has just become too compromised.

This is one piece of malware that most conventional antivirus engines are ill equipped to really deal with. And one variant has even been found to completely break Windows Defender. This is why if such an infection is found, I recommend that the reader in question seek out professional help.

Thank You for reading, I invite readers to comment with any questions or comments.