This link shows the find.

by R. Proffitt Moderator - 11/28/12 7:09 AM

In Reply to: ZEROACCESS rootkit symptoms found! by Lisaponcho

http://forums.cnet.com/7726-6122_102-5389967.html?tag=posts;msg5389967

There's more at the link but it was found with RKILL. There may be a few more clues in the output from RKILL at the link.
Bob