Threat Search: 

ThreatExpert's Statistics for NTRootKit-H [McAfee]:

NTRootKit-H [McAfee] is also known as:
Threat AliasNumber of Incidents
Troj/Spy-AS [Sophos]2
Trojan:Win32/Zbot.AT [Microsoft]2
Trojan-Spy.Win32.Zbot.dkf [Ikarus]2
Trojan-Spy.Win32.Zbot.dkf [Kaspersky Lab]2
TSPY_ZBOT.OJ [Trend Micro]2
Win32/IRCBot.worm.variant [AhnLab]2
Backdoor.Paproxy!sd6 [PC Tools]1
HackTool.Agent.COKF [PC Tools]1
Hacktool.Rootkit [Symantec]1
HackTool.Win32.Hidd.h [Kaspersky Lab]1
HackTool.Win32.Hidd.j [Kaspersky Lab]1
Packed.Generic.187 [Symantec]1
TROJ_ROOTKIT.EN [Trend Micro]1
Trojan Horse [Symantec]1
Trojan-Downloader.Hidden [PC Tools]1

NTRootKit-H [McAfee] has the following possible country of origin:
OriginNumber of Incidents
Russian Federation1

NTRootKit-H [McAfee] is known to be created as:
%System%\hdaaz.dll
%System%\hdtql.dll
%System%\ntos.exe
Note: %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).