Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

My System has affect Rootkit.Sirefef.Gen Virus. So i want to know which antivirus software is used to remove Rootkit.Sirefef.Gen virus file.

share|improve this question
Your Windows installation disc is the best solution. Boot on it, format your drives, reinstall. Problem solved. –  user42178 Sep 15 '14 at 10:20

2 Answers 2

Rootkit.Sirefef.Gen is not a specific specimen of malware as such. The ‘.Gen’ typically means the AV scanner has picked it up through generic heuristic algorithms as something that looks like Sirefef (ZeroAccess) rather than 100% matching a specific signature.

There is a large extended family of trojans that would trigger a detection like this and no way to know what exact strain you have, so no way to tell for sure what, if any, AV would reliably remove it. Because this is a well-known family you would hope that most competent AV should be able to remove it, but it's always possible you have some variant that differs and might not be 100% removed - and you would have no way of knowing.

As usual, if your machine has been compromised the only certain way to recover it is to reinstall the OS from scratch.

share|improve this answer

I figured out a way to thwart rootkits though it will not totally remove it. I simply added a malware process destroyer into my boot sequence. I used Rkill, as this program was able to detect the malware. However, after deleting it, the rootkit would generate the files again on startup.

By putting rkill into my startup I effectively rendered the rootkit inert. Assuming the rootkit is faster than rkill, I was thinking (though I didn't actually get a chance to) that in task manager you could set the priority of rkill to high and that of the malware to low.

As a sidenote, though it slows startup, having rkill in there isn't a bad idea for general malware defence.

Rkill can be downloaded from bleepingcomputer:



share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.