Major shift in strategy for ZeroAccess rootkit malware, as it shifts to user-mode | Naked Security
"This new version of ZeroAccess is being aggressively distributed through the normal mechanisms - drive by downloads, fake keygens, fake game downloads....."