Necurs has been one of the most prevalent rootkits out there. In 2012 Necurs has been found on 83,427 unique machines as reported by Microsoft. As of today new samples of this rootkit are still being created and integrated with popular malware such as ‘Zeus’. In this presentation Nico will discuss the symptoms of being infected by necurs rootkit, the rootkit installation and the things that happen when the rootkit owns an infected machine.