Daily Trojan

system · 2015-11-27T21:04:10.000Z

Ok, still no sign of the Trojan, so it seems to be gone…Thank you so much for hanging in there with me and finding the culprit…wish I could get my hands on the culprit who sent it to me. I would like to pay you something, and would also like to see if you could help me with a dispute I have ongoing since May with Avast for charging me $119 for an unsuccessful remote session that lasted 4-5 hours, and which I did not request. My computer repairman did write a letter attesting to the fact that the session did not repair my problem.
But that aside, I really do appreciate your assistance. KW

dbrisendine · 2015-11-28T04:52:40.000Z

I’m glad the trojan is gone. As to the other matter, I’m not sure I can help you any as I am not affiliated with Avast in any way. I am just a trained volunteer helping out here as best I can.

Have a very Merry Holidays and surf safely!

system · 2015-11-29T20:09:43.000Z

I am grateful for your assistance…please don’t think the amount of my donation reflects the amount of gratitude I feel…just my circumstances. KW

system · 2015-11-29T22:36:20.000Z

Celebrated too soon, I’m afraid…same Trojan back on today’s mbar scan. Do you mind helping? No recycle bin showing in C drive, even after “un-hiding” hidden files.

Pondus · 2015-11-29T22:51:09.000Z

It is not in the log you attached?

system · 2015-11-29T23:32:58.000Z

Problems with the page I guess, MBAR file didn’t show up…trying again.

Pondus · 2015-11-30T00:18:15.000Z

Your log is here, but the first one you attached did not show any detections

The one you attached now does

Malwarebytes Anti-Rootkit BETA 1.9.3.1001 www.malwarebytes.org
Database version:
main: v2015.11.29.04
rootkit: v2015.11.26.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Owner :: KATHYSLAPTOP [administrator]

11/29/2015 3:35:31 PM
mbar-log-2015-11-29 (15-35-31).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 352030
Time elapsed: 21 minute(s), 10 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKU\S-1-5-21-930250783-1986003217-1596953152-1000_Classes\CLSID{FBEB8A05-BEEE-4442-804E-409D6C4515E9} (Hijack.Trojan.Siredef.C) → Delete on reboot. [6266fa899dee0d29f6566d9451afa15f]

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

system · 2015-11-30T01:35:41.000Z

I have wasted the last hour trying to get a screen print or snipped copy of the scan done at 3:35pm, which is when the Trojan appeared.
MBAM is not performing as usual to export a scan log, and I don’t have all night to work on it. I want to get the exact location to you, but have trouble right now…wish you could just copy and paste a line from MBAM,can’t. The log I sent earlier, was from an earlier scan, and it didn’t show up on that scan…the reason I scanned again, is that the computer froze, as it often does when it is infected with this Trojan, so, I had to shut it down and restart it, then scan…what I always do when that happens.

The issue now, is how I can scan the external hard drive I’ve been using for backup…no doubt the Trojan is there, too. Can I open MBAM within the Ext. HDD and run it in the drive? or is there a trick to it? If I ever have to restore from that drive, I don’t want to restore my old Trojan.

system · 2015-11-30T02:52:13.000Z

I got a pop-up notice “Malware Detected”, so finally got you an instance in MBAM…this after I had rebooted, which was supposed to delete the one found earlier this afternoon.

system · 2015-11-30T05:16:11.000Z

Another instance of the “demon Trojan” located 11-30-15 at 12 15 am.

dbrisendine · 2015-11-30T05:26:54.000Z

Let’s get a second opinion on this …

Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_1.jpg

[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

http://i1351.photobucket.com/albums/p785/dbreeze2/just%20stuff/TDSSKiller_options2015-01-10_zpse37afaba.png

[*]Click the Start Scan button.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_3.jpg

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_4.jpg

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_5.jpg

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of “TDSSKiller.[Version][Date][Time]_log.txt”. Please copy and paste its contents on your next reply.

system · 2015-11-30T22:49:49.000Z

No threats today, although the computer has frozen and had to be shut down 3 times,…I was online when that happened.

dbrisendine · 2015-12-01T05:07:33.000Z

Did you ever get your $Recycle.Bin folder back? Does your Recycle Bin function properly (you can delete file and recover them from the Recycle Bin “trash can”)?

system · 2015-12-01T23:56:54.000Z

The Recycle bin on the desktop is still functional…just no folder appears on the C drive. MBAM and TDSS both scanned with no malware found! (Happy Face) Will hope it’s beaten??

system · 2015-12-03T03:46:11.000Z

MBAR report: HKU\S-1-5-21-930250783-1986003217-1596953152-1000_Classes\CLSID{FBEB8A05-BEEE-4442-804E-409D6C4515E9} (Hijack.Trojan.Siredef.C)
Am scanning with MBAM now…is there any way to get rid of this Trojan? On Bleeping Computer I saw some programs specifically aimed at the removal of this Trojan…would it be safe to try one of them??

Unfortunately, I forgot to run the TDSS scan first…it came back negative for malware, following the MBAR scan.

dbrisendine · 2015-12-03T04:24:22.000Z

First it’s there and then it is not there …

I would say to try the programs but use common sense. If you want, tell me what they are and I will check them out first.

system · 2015-12-03T07:03:46.000Z

Ok, I’ll do it tomorrow night, probably…it’s nearly 2am, and I have to work in the afternoon…I’ve been trying to transfer photos to a zip drive, and it seems all 3 of my usb ports are disabled. copied photos to a dvd drive, so I can transfer them to another computer, I’m trying to get them to my mini sd so I can transfer them to my tablet…I hope my drives aren’t going to disappear like my desktop drives did…my computer guy has that one, and I’m hoping it can be rebuilt…I don’t know yet.

system · 2015-12-16T04:40:50.000Z

Returned from 5 days with no internet…finished going through junk mail folder, scanned with MBAM, attaching report…same old Trojan still there.

dbrisendine · 2015-12-16T06:08:56.000Z

I don’t give up easily but I feel that this is one that needs to be looked at over at the MalwareBytes forum. You can find help and directions on getting start there in this post. I just feel that they know their products better than anyone else and can handle the behind the scenes workings best.

system · 2015-12-16T21:12:34.000Z

Ok, will do…thank you for your help.

Announcements