Win32:Sirefef-ZT

Posted: October 15, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	24

First Seen:	October 15, 2012
OS(es) Affected:	Windows

Win32:Sirefef-ZT is a Trojan that's injected into the process Services.exe (a normal Windows file) by other components of the Sirefef or ZeroAccess infection. Win32:Sirefef-ZT also is responsible for exerting control over another component, the Trojan Trojan:Win64/Sirefef.Y, which disables your firewall and creates a backdoor vulnerability in your computer. SpywareRemove.com malware researchers recommend that you treat Win32:Sirefef-ZT as a high-level threat to your computer, since Win32:Sirefef-ZT always will be installed along with other Sirefef-based Trojans that can be responsible for attacks up to and including the theft of highly confidential information. Since Win32:Sirefef-ZT's code is utilized from within a Windows process, you should use appropriately advanced anti-malware programs to delete Win32:Sirefef-ZT and other Sirefef-based PC threats as soon as possible.

Win32:Sirefef-ZT and the Download that Douses Your Firewall

Sirefef Trojans like Win32:Sirefef-ZT (which, due to its code insertion into Services.exe, also may be labeled as a virus) usually are installed by a single dropper or downloader for the family, which infects PCs by various methods. Infection vectors for Sirefef-based PC threats like Win32:Sirefef-ZT Trojans include both spam e-mail links as well as media codecs, illegal game installers and piracy tools like key generators/software cracks. Once Win32:Sirefef-ZT is installed, Win32:Sirefef-ZT launches with Windows and doesn't display separate file or memory process – a malicious defense technique that SpywareRemove.com malware experts have found to be common to the Sirefef/ZeroAccess family.

Win32:Sirefef-ZT is designed to load a second Trojan, which is identified as Trojan:Win64/Sirefef.Y, Win64/Sirefef.W or Trojan.Sirefef.FR. Sirefef.Y deactivates the service associated with Windows Firewall and also opens a port that can be accessed by Command & Control servers. This state of affairs creates an overall vulnerability on your computer that can be used to attack it, with typical attacks including the installation of other malware or the transferal of private information (passwords, account names, and similar) from your PC to a remote server. SpywareRemove.com malware researchers also warn that Win32:Sirefef-ZT doesn't display symptoms of its activities.

Why Stopping Win32:Sirefef-ZT is a Far from Hopeless Struggle

While Win32:Sirefef-ZT doesn't have any symptoms that are linked to its attacks, overall Sirefef infections may be responsible for several side effects that can be observed as indications of the necessity of hasty anti-malware scans. Poor system performance, periodic loss of Internet connectivity, disabled security programs (particularly the aforementioned Windows Firewall) and unusual system resource usages all may be related to the presence of Win32:Sirefef-ZT and other Sirefef Trojans. Since Sirefef Trojans remain high on the list of heavily-distributed PC threats, SpywareRemove.com malware researchers recommend scanning your PC after any hint of the above problems appearing on a recurring basis.

Because of the advanced nature of Win32:Sirefef-ZT and its complicity with related PC threats, some anti-malware programs may be able to detect but unable to remove Win32:Sirefef-ZT. Guidelines that SpywareRemove.com malware analysts have offered to help mitigate these situations include:

Updating all databases for your anti-malware programs so that they can identify recent variants of Sirefef and Win32:Sirefef-ZT.
Using Safe Mode for all scans, which will disable relatively primitive PC threats that don't use boot loader-related exploits or other types of advanced coding tricks.
Installing a backup operating system onto a USB device, which can be used to boot your machine safely.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Win32:Sirefef-ZT may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner*

* See Free Trial offer below. EULA and Privacy/Cookie Policy. * See Free Trial offer below. EULA and Privacy/Cookie Policy.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Win32:Sirefef-ZT

Threat Metric

Win32:Sirefef-ZT and the Download that Douses Your Firewall

Why Stopping Win32:Sirefef-ZT is a Far from Hopeless Struggle

Use SpyHunter to Detect and Remove PC Threats

Leave a Reply