Win32/Sirefef.FB.Gen

Posted: July 4, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	13,270
Threat Level:	2/10
Infected PCs:	740

First Seen:	July 4, 2012
Last Seen:	September 25, 2023
OS(es) Affected:	Windows

Win32/Sirefef.FB.Gen is a component of a Sirefef Trojan or ZeroAccess Rootkit infection that's often found infecting services.exe – a native component of Windows. Because Win32/Sirefef.FB.Gen was only added to the databases of many PC security companies late in June of 2012, your anti-malware applications may be unable to find Win32/Sirefef.FB.Gen if they haven't been updated. Like all members of this family, Win32/Sirefef.FB.Gen should be considered a high-level threat to your computer, since Win32/Sirefef.FB.Gen can be found in browser hijacks, sabotaged security software, the installation of other PC threats or usage of your computer's resources to commit fraud and other crimes.

When the Game's Crack Decides to Crack Your PC

Because Win32/Sirefef.FB.Gen is just one piece of a multiple component infection for a variant of Sirefef, Win32/Sirefef.FB.Gen is almost never found alone and doesn't have any known means of distributing itself or infecting other computers. Under normal circumstances, Win32/Sirefef.FB.Gen infections are accompanied by other Sirefef components and installed by an associated Trojan dropper. Trojan droppers for Win32/Sirefef.FB.Gen and closely-related PC threats are often distributed as fake key generators, game cracks and other forms of software piracy-promoting applications.

After the installing Trojan has completed its payload, other components, including Win32/Sirefef.FB.Gen, may be injected into normal system processes or installed as compromised files that replace the original ones (which may be deleted, in some cases necessitating a reinstall of Windows). Win32/Sirefef.FB.Gen, in particular, has been seen infecting Windows\System32\services.exe, AKA the Services and Controller application that starts and terminates services. Accordingly, SpywareRemove.com malware researchers note that Win32/Sirefef.FB.Gen has a high chance of being involved in the arbitrary termination of other programs and Windows features (especially security-oriented ones).

Win32/Sirefef.FB.Gen's Small Piece of the Whole Sirefef Puzzle

Win32/Sirefef.FB.Gen may block you from using anti-malware programs that could remove both Win32/Sirefef.FB.Gen and related PC threats, but manual deletion for high-level threats like a ZeroAccess rootkit is never recommended. Instead, you should attempt to block Win32/Sirefef.FB.Gen and other components of the Sirefef infection by booting your PC from a removable media-based device. From an uninfected OS, you can scan your PC and delete Win32/Sirefef.FB.Gen safely with appropriate software.

PC threats that SpywareRemove.com malware researchers have also seen associated with Win32/Sirefef.FB.Gen infections include (but aren't restricted to):

HTML/ScrInject.B.Gen – a heuristic detection for a malicious script that's injected into a web page (to steal personal information, display extra advertisements, etc.).
Win32/InstallCore.D
The Babylon Toolbar, an adware program that promotes itself as a translation utility. However, SpywareRemove.com malware researchers note that recent versions of the Babylon Toolbar have been updated to remove many potentially malicious functions.
Win32/Agent.TEO Trojan

Adjoining this are other components of a Sirefef infection, such as Trojan:Win32/Sirefef.AC, Trojan:Win32/Sirefef.AB, Trojan:Win32/Sirefef.S and Virus:Win32/Sirefef.D.

Technical Details

Additional Information

The following URL's were detected:

mydesktopdefender.com