According to research from Sophos, a new variant of the malware has been armed with a kernel-level rootkit that stops users from killing the Gameover process and makes it difficult to remove the Trojan. Known as Necurs, the rootkit has been added to protect the malware files on disk and in memory.