Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

My System has the rootkit Rootkit.Sirefef.Gen. I would like to know how I can remove this rootkit.

share|improve this question

closed as off-topic by AviD Sep 16 at 9:16

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

Your Windows installation disc is the best solution. Boot on it, format your drives, reinstall. Problem solved. – user42178 Sep 15 '14 at 10:20

3 Answers 3

Rootkit.Sirefef.Gen is not a specific specimen of malware as such. The ‘.Gen’ typically means the AV scanner has picked it up through generic heuristic algorithms as something that looks like Sirefef (ZeroAccess) rather than 100% matching a specific signature.

There is a large extended family of trojans that would trigger a detection like this and no way to know what exact strain you have, so no way to tell for sure what, if any, AV would reliably remove it. Because this is a well-known family you would hope that most competent AV should be able to remove it, but it's always possible you have some variant that differs and might not be 100% removed - and you would have no way of knowing.

As usual, if your machine has been compromised the only certain way to recover it is to reinstall the OS from scratch.

share|improve this answer

I figured out a way to thwart rootkits though it will not totally remove it. I simply added a malware process destroyer into my boot sequence. I used Rkill, as this program was able to detect the malware. However, after deleting it, the rootkit would generate the files again on startup.

By putting rkill into my startup I effectively rendered the rootkit inert. Assuming the rootkit is faster than rkill, I was thinking (though I didn't actually get a chance to) that in task manager you could set the priority of rkill to high and that of the malware to low.

As a sidenote, though it slows startup, having rkill in there isn't a bad idea for general malware defence.

Rkill can be downloaded from bleepingcomputer:


share|improve this answer

Most Security companies offer free rootkit removal utilities. Off the top of my head, I can remember Malwarebytes, Kaspersky (called TDSSKiller), Bitdefender and Intel (formerly McAfee).

Download any of those, preferably from a different computer, install it on a USB and boot it on your infected computer (some of them run inside Windows, I would recommend running at least one USB based version though, because rootkits have full administrator access, and can cause problems.)

Malwarebytes Anti Malware is also a decent on demand scanner, if you want to use it, make sure to check the "scan for rootkits" checkbox. Don't rely on it for rootkits though.

RKill apparently only terminates the process of the rootkits. You should run whatever your antivirus is afterwards.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.