VirTool:WinNT/Rootkitdrv.HS Description

VirTool:WinNT/Rootkitdrv.HS is dangerous malware with rootkit functionality. VirTool:WinNT/Rootkitdrv.HS may enter a system bundled with other malware or internet downloads. VirTool:WinNT/Rootkitdrv.HS uses stealth tactics to operate without being detected. When inside a system, it will make changes to the Windows registry and drop malicious files onto the system. VirTool:WinNT/Rootkitdrv.HS may also slow down the operations of a system and cause it to crash. VirTool:WinNT/Rootkitdrv.HS is a security risk that should be extinguished from a compromised machine immediately after it is detected.

Aliases: W32/Tiny.A!tr.rkit [Fortinet], Win32.Tiny.A.Rkit [eSafe], Artemis!68857466541B [McAfee], Win32:Eorezo-G, W32/Agent.GGYM!tr [Fortinet], Malware/Win32.Inno [AhnLab-V3], DR/StartPage.agyh.5 [AntiVir], Trojan.Siggen2.12629 [DrWeb], Trojan.Win32.S.Agent.1874320, VBS_INNO.AE, W32/StartPage.ALMH, Artemis!BE8EA443C780 [McAfee], Generic Rootkit [Panda], W32/ZAccess.C!tr.rkit [Fortinet] and Hacktool.Rootkit.

Technical Information

File System Details

VirTool:WinNT/Rootkitdrv.HS creates the following file(s):
# File Name Size MD5 Detection Count
1 D:\MISA\PROGRAMI\CRYPTLOAD 1.1.8 + IP CHANGER\router\FRITZ!Box\nc.exe 61,440 ab41b1e2db77cebd9e2779110ee3915d 388
2 %USERPROFILE%\My Documents\Downloads\MoH2010\Medal Of Honor Limited Edition_Crack\Binaries\Crack1\Binaries\SecuROM.dll 144,896 0f176c410f05cd8f7c1268674a21d262 65
3 %TEMP%SoftwareProtection.exe 314,456 8ac110d9eea01b33a7cbf614f7f3d2c8 16
4 %WINDIR%\system32\gloom.sys 5,632 68857466541bb1b800d48caf3a79ae83 9
5 %WINDIR%\System32\drivers\ag02.sys 14,592 241b9318dfe7f887da2bb6a1304db829 8
6 %PROGRAMFILES%\\NeapolNet.exe 257,536 40d767b25a2433cb34371740ecee2ad7 5
7 %WINDIR%\System32\DRIVERS\update.sys 384,768 b4f334ee63329e31f5f5a106f1274468 4
8 `.vbe 6,351 1ee104ec7956ec629513fab340cdc876 3
9 C:\RECYCLER\VVisit.exe 1,404,928 9ac1a518343130e14b0994efcba9f737 3
10 %PROGRAMFILES%\Windows Live\Messenger\msngserv.exe 47,104 00c2be29de6d10ca331890e971621a93 2
11 %PROGRAMFILES%\Screen Calendar\scrcal.exe 2,206,661 bf80e48b44cbc6a56450605da8fc6a14 2
12 %WINDIR%\System32\DRIVERS\netbios.sys 34,688 cc760b29d88869a51d9b7fc3c08e1a3c 2
13 %WINDIR%\System32\DRIVERS\redbook.sys 57,600 9ed828b092be4a6df3fa6140c3c1496c 2
14 %WINDIR%RegCtrlwow.exe 499,200 303f047429d5344c78759eb38ea8a345 2
15 %WINDIR%\system32\mscms32.dll 252,416 6d1c7ccdc56f4c27272ccf6fb7bdcb67 2
16 %WINDIR%\system32\authz32.dll 418,816 36e411823194c0e1fe91b8f75d3a6b4d 2
17 D:\Belgeler\1299_Client_HiimOki\SkyShield.sys 8,422 30cbd19534aed6fc0611b3146f7722a2 1
18 %WINDIR%\System32\DRIVERS\ndiswan.sys 91,520 d618eedfdbe3c753c9bf82611427fad5 1
19 %WINDIR%\System32\DRIVERS\i8042prt.sys 53,248 77022784e8da14515d1f09fe38f5e8f9 1
20 %ALLUSERSPROFILE%api-ms-win-core-handle-l1-1-032.dll 260,608 83a2806d43cdd608df238cd802481f2e 1
21 %USERPROFILE%\Mes documents\PHOTOSHOP\CADRES\pctuto_353.exe 1,874,320 be8ea443c78032bb9ebc8c27d7b195b0 1

Site Disclaimer is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.