Help to block ZeroAccess
This is not the definitive solution, but on 95% of ZeroAccess versions, help.
Paste this on your gateway, and ask the client to clean his device, if the IP are logged and if it not are one false positive.
/ip firewall filter
add action=log chain=forward comment=ZeroAccess connection-state=new dst-port=16464-16465,16470-16471 protocol=udp
add action=drop chain=forward comment=ZeroAccess connection-state=new dst-port=16464-16465,16470-16471 protocol=udp