Cyber gangs fighting over infected PCs

"TDL3 Authors sold a version of TDL3 sourcecode to ZeroAccess authors. Now ZeroAccess guys are double crossing the TDL3 author by uninstalling the TDL rootkit," Erasmus told El Reg, adding that the behaviour recalls earlier turf wars between purveyors of the ZeuS and SpyEye banking Trojans when the latter begun bundling functions to nuke instances of ZeuS from PCs it infected in order to gain sole control of compromised boxes.

ZeroAccess is spreading rapidly via cracks and keygens websites. The malware is particularly difficult to eradicate because it goes out of its way to prevent security software from running on infected machines, as illustrated by a video on YouTube made by Webroot.