Posted: March 7, 2012

Rootkit.0access.H Description

Rootkit.0access.H is an upgraded variant of the prolific ZeroAccess rootkit, a multi-component rootkit that modifies the victim's online searches to produce fraudulent Pay-Per-Click revenue. Because Rootkit.0access.H has been modified to enhance its ability to stay away from detection and removal, malware analysts emphasize the importance of updating your anti-malware software so that it can find and remove Rootkit.0access.H and related PC threats. Other symptoms of a Rootkit.0access.H infection can include Blue Screens of Death, malfunctioning security applications and the presence of other forms of malicious software, such as Alureon Trojans. You should always consider Rootkit.0access.H a high-level danger to your PC and remove it with qualified anti-malware products, since Rootkit.0access.H has been known to avoid deletion by built-in security features like System Restore.

Getting to the Root of Problems with Rootkit.0access.H

Rootkit.0access.H doesn't have any benevolent functions for your PC and, like ZeroAccess, may be installed via drive-by-download exploits or by Trojans like Zlob. It's unlikely that you'll be able to see any signs of Rootkit.0access.H's initial installation, which lacks visible symptoms; although Rootkit.0access.H will make its presence more obvious than this once, Rootkit.0access.H begins its various attacks. malware researchers have noted the following hostile functions, in rough order of visibility, that can originate from Rootkit.0access.H:

  • Browser hijacks that redirect your web searches and send you to unrelated and potentially harmful sites. Rootkit.0access.H's predecessor, ZeroAccess, uses these attacks for click-based revenue, although Rootkit.0access.H may also exploit them for other purposes.
  • Problems with your anti-malware and security programs that prevent you from scanning your PC or removing Rootkit.0access.H.
  • Windows's own (and very distinctive) blue error screen (AKA the 'Blue Screen of Death' or BSOD), which is likely to appear after an incomplete attempt to delete Rootkit.0access.H.
  • You may also notice unusual expenditure of system resources or a slowdown of Windows due to Rootkit.0access.H's activities.

Prying Up Rootkit.0access.H and Everything That's Attached to It

As an unpleasantly improved version of the ZeroAccess rootkit, Rootkit.0access.H is even more difficult to remove than a typical rootkit, and malware experts have noted its ability to restore itself after a System Restore rollback. Rootkit.0access.H may also be stay active after a Safe Mode boot, and exceptional measures (such as launching Windows from an external drive) may be required to insure an ideal environment for Rootkit.0access.H's removal. Rootkit.0access.H also conceals many of its components in locations that are considered system critical by many types of anti-malware scanners, which makes it even more necessary than usual to update your security software, if updates are available.

Last of all, malware research team warns Rootkit.0access.H may come with a small host of other PC threats that are installed with Rootkit.0access.H or by Rootkit.0access.H. PC threats that have been known to be linked to Rootkit.0access.H include Trojan:Win32/Alureon.FA, Trojan:Win32/Alureon.gen!G, Trojan:Win32/Alureon.EN, Trojan:WinNT/Alureon.AA, Trojan:Win64/Alureon.gen!I, TrojanDownloader:Java/OpenConnection.PK, TrojanDownloader:Java/OpenConnection.PI and TrojanDownloader:Java/OpenConnection.PH.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Rootkit.0access.H may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM].exe"
Home Malware Programs Rootkits Rootkit.0access.H

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.