PTCH_SIREFEF.L

Posted: July 23, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	29

First Seen:	July 23, 2012
OS(es) Affected:	Windows

PTCH_SIREFEF.L is a generic detection for a system file (typically services.exe, the 'Services Control Manager' for Windows) that's been infected by a member of the Sirefef family. PTCH_SIREFEF.L is usually used to launch other Sirefef-based PC threats automatically, and, as such, can display a range of different symptoms – or to the converse, no symptoms at all. Standard behavior for PTCH_SIREFEF.L and similar PC threats includes code-injection into unrelated memory processes, which provides an additional layer of concealment against visual detection. SpywareRemove.com malware experts encourage you to use anti-malware software to find and remove PTCH_SIREFEF.L whenever necessary, particularly since PTCH_SIREFEF.L can be involved in attacks that disable crucial security functions, install other PC threats or expose you to malicious web content.

PTCH_SIREFEF.L – the Windows Add-On That No One Needs

Like Troj_Sirefef.kby, Win32/Sirefef.FB.Gen, Trojan horse Patched_c.LZE, Trojan.Patchep!sys, Trojan Horse Patched_c.LYT or Trojan Horse Patched_c.LYU, PTCH_SIREFEF.L isn't detectable as a separate file after its installation, although anti-malware programs can detect PTCH_SIREFEF.L as an infected services.exe or other Windows file. Unlike viruses, PTCH_SIREFEF.L can't infect other files besides the one that PTCH_SIREFEF.L is originally inserted into, and repairing this lone file may allow you to put an end to PTCH_SIREFEF.L – but unless you can also remove related PC threats simultaneously, chances are high that PTCH_SIREFEF.L will be reinstalled by other Sirefef Trojans.

Sirefef (also known as Max++ or ZeroAccess) components usually are inserted into separate memory processes that are native to Windows; this allows PTCH_SIREFEF.L and its relatives to launch themselves without being detected. While you may be able to observe RAM or CPU discrepancies in Task Manager to detect PTCH_SIREFEF.L, SpywareRemove.com malware experts recommend using anti-malware programs that are designed to identify rootkits and similar PC threats, especially given that PTCH_SIREFEF.L and other Sirefef components can install malicious software from outside their family as well as from inside it.

Why Giving PTCH_SIREFEF.L a Home in Your OS is to Your Disadvantage

While PTCH_SIREFEF.L's own functions are reserved to coordinating the activities of other Sirefef components, SpywareRemove.com malware experts have noted that, taken as a whole, a Sirefef infection is capable of significantly-damaging attacks. Some of the most common and noteworthy problems that you may experience while PTCH_SIREFEF.L and its kin are on your computer include:

Browser-based search redirects that alter your search results or expose you to malicious websites.
Exploiting your PC's resources (memory, etc) for crimes that can include digital currency fraud. In some cases, this may degrade your PC's performance and stability.
Windows security programs (Windows Firewall, Windows Security Center and Windows Defender, for example) and features being disabled.
The installation of other types of PC threats, such as banking Trojans that steal bank account passwords or fake security programs that display fraudulent system alerts.

PTCH_SIREFEF.L is still in distribution as of the time of this writing, and SpywareRemove.com malware experts also note that PTCH_SIREFEF.L is confirmed to be able to attack modern versions of Windows, such as Windows 7 Professional.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

servicesASDF.rar

File name: servicesASDF.rar
Size: 110.49 KB (110491 bytes)
MD5: d76eae2e621d516f331f2560ecfe4ed4
Detection count: 96
Mime Type: unknown/rar
Group: Malware file
Last Updated: July 24, 2012