The term "rootkit" has negative connotations through its association with malware. Mebroot is a master boot record based rootkit used by botnets including Torpig. Mebromi installs a rootkit which infects the master boot record. Hacker Defender (hxdef) is an open source rootkit for Windows. Unix rootkit detection offerings include Zeppoo, chkrootkit, rkhunter and OSSEC. In 2005, Russinovich discovered the Sony rootkit in Sony DRM products. For the vulnerable Q35 chipset, a keystroke logger ME-based rootkit was demonstrated by Patrick Stewin. Difference-based detection was used by Russinovich's "RootkitRevealer" tool to find the Sony DRM rootkit. The intruders installed a rootkit targeting Ericsson's AXE telephone exchange. In January 2006, Russinovich discovered a rootkit in Norton SystemWorks by Symantec. The bot itself is spread through the ZeroAccess rootkit through a variety of attack vectors. This exploit was equivalent to a rootkit. However, this is not the case with a kernel type rootkit. Blue Pill is the codename for a rootkit based on x86 virtualization. This makes detecting hidden processes created by the rootkit extremely difficult.