The Rootkit.ZeroAccess virus, also known as Sirefef, is a malicious program used for financial gain through pay-per-click advertising – also known as click fraud. The virus is also capable of downloading other malware onto the computer, which scares the user into believing that their computer is filled with a hoard of infectious threats. Bogus anti-virus software pretends to detect and remove these threats for a fee.

1. Jupiter Support - ZeroAccess Rootkit Removal
The Rootkit.ZeroAccess virus, also known as Sirefef, is a malicious program used for financial
gain through pay-per-click advertising – also known as click fraud. The virus is also capable of
downloading other malware onto the computer, which scares the user into believing that their
computer is filled with a hoard of infectious threats. Bogus anti-virus software pretends to
detect and remove these threats for a fee.
The Rootkit.ZeroAccess virus disables the system security application and Windows Firewall
settings, thus creating security loopholes in your computer which is then used to record your
Internet activities or distribute pop-up ads. These affect the speed and functionality of the
computer, bringing on frequent crashes.
If you see the following display, you can be sure that you have been infected with the
Rootkit.ZeroAccess virus:
System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.
This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.
The correct system performance cannot be resumed without eliminating the cause of lsass.exe
corruption.
System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.
Warning!
Name: firefox.exe
Name: c:program filesfirefoxfirefox.exe

2. Application that seems to be a key-logger is detected. System information security is at risk. It is
recommended to enable the security mode and run Rootkit.ZeroAccess scanning.
Once on your system, this nasty virus redirects every browser search result click to the
Rootkit.ZeroAccess purchase page. It takes full control of your computer to the extent of even
incapacitating your antivirus software. Unfortunately, as a result, your antivirus software is
deemed useless, mainly because it fails to detect or remove the Rootkit.ZeroAccess infection.
In a situation like this, Jupiter Support, online virus removal experts, recommend the manual
removal of the Rootkit.ZeroAccess virus.
Follow these steps to effectively axe the virus:
1. Click the Start menu, select Run.
2. Type taskmgr.exe into the Run command box, and click “OK.” You can also launch the Task
Manager by pressing keys CTRL + Shift + ESC.
3. Click Processes tab, and find Rootkit.ZeroAccess related processes.
4. Once you’ve found the Rootkit.ZeroAccess related processes, right-click them and select “End
Process” to kill Rootkit.ZeroAccess related process.
5. With all programs closed, click the Start Menu and go to the Control Panel.
6. Locate the Add/Remove Programs icon and double click it.
7. Locate Rootkit.ZeroAccess in the list of programs. If you find it, select it and remove it.

3. How to delete Rootkit.ZeroAccess files in Windows XP/Vista/7:
1. Click your Windows Start menu, then click “Search.”
2. A pop up will ask, “What do you want to search for?” Click “All files and folders.”
3. Type a Rootkit.ZeroAccess file in the search box, and select “Local Hard Drives.”
4. Click “Search.” Once the Rootkit.ZeroAccess file is found, delete it.
Detect and delete Rootkit.ZeroAccess associated files listed below:
%UserProfile%Application DataMicrosoft[random].exe
%System Root%Samples
%User Profile%Local SettingsTemp
%Program Files%Rootkit.ZeroAccess
%Program Files%Rootkit.ZeroAccess
C:ProgramData[random numbers]
%Documents and Settings%All UsersStart MenuProgramsRootkit.ZeroAccess
%Documents and Settings%All UsersApplication DataRootkit.ZeroAccess
doguzeri.dll
3948550101.exe
3948550101.cfg
Open the Registry Editor, search and delete these Rootkit.ZeroAccess Registry Entries:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
Execution Optionsekrn.exe “Debugger” = ‘svchost.exe’
NTCurrentVersionImage
File

4. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
Execution Optionsmsascui.exe “Debugger” = ‘svchost.exe’
NTCurrentVersionImage
File
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
NTCurrentVersionImage
Execution Optionsmsmpeng.exe “Debugger” = ‘svchost.exe’
File
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
Execution Optionsmsseces.exe “Debugger” = ‘svchost.exe’
File
NTCurrentVersionImage
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet
“WarnOnHTTPSToHTTPRedirect” = ’0′
Settings
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet
“WarnOnHTTPSToHTTPRedirect” = ’0′
Settings
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
“DisableSR ” = ’1′
NTCurrentVersionSystemRestore
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “zzz”
HKEY_CURRENT_USERSoftwareRootkit.ZeroAccess
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallRootkit.Zer
oAccess
HKEY_LOCAL_MACHINESOFTWARERootkit.ZeroAccess
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun “3948550101″
Although the manual process is the most effective way to banish the Rootkit.ZeroAccess virus,
Jupiter Support agrees it can be quite a cumbersome procedure that requires the indisputable
support of computer professionals. This is mainly because since some files may be hidden or
may automatically reanimate themselves later.
For a permanent fix to any such problematic viruses, Jupiter Support recommends its proficient
Rootkit.ZeroAccess virus removal service. This service provides instant solutions to abrupt virusrelated situations. With a clear understanding of what rootkits are, the symptoms they bring
about and the cure we bring, customers are educated on how they can keep their computers
free of any such threats and also how to deal with these threats, if ever faced with again.

5. With rootkit removal from Jupiter Support, you get complete scan and detection for:











Viruses
Spyware
Adware
Trojans
Malware
Issues with hard drive
Errors in device configuration
Installation errors
Corrupted system files
Computer networking problems
Corruption of Windows 8, Windows 7, Windows Vista or Windows XP