Help Please - Sirefef removal

Hi,

I’m working on a machine which had a number of infections, most of which I’ve sorted using MBAM and Avast free. Avast is now reporting activity about every 5 minutes when a file is created (and blocked by Avast), labelling it as either Win32:Malware-gen or Win64:Sirefef-AO or Win32:Sirefef-A.

I’m presuming there’s a rootkit or something that is continually dropping these files, but can’t be detected or removed by Avast (even boot time scan). I’m hoping to get some help with cleanup and removal - if it comes to a format and reinstall I can manage that on my own.

System: Windows Vista Home Premium SP2 32 bit, all updates installed.

Hi mbouy,

Thank you for the logs attached.

Now you wait for a malware expert to assist you in cleaning your system. Follow all instructions and run only the programs and post logs requested.

A malware expert has been notified.

Hi mbouy, welcome to the forum.

To make cleaning this machine easier
[*]Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
[*]Please do not run any scans other than those requested
[*]Please follow all instructions in the order posted
[*]All logs/reports, etc… must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
[*]Do not attach any logs/reports, etc… unless specifically requested to do so.
[*]If you have problems with or do not understand the instructions, Please ask before continuing.
[*]Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

[*]Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer’s settings, including making I-E the default browser.
3. If after running combofix you recieve an message “Illegal operation attempted on a registery key that has been marked for deletion” or similar reboot the computer.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Hello Oldman,

thanks for your response - combofix log is attached.

btw - I didn’t receive an email when you replied to this thread, hence the long delay.

thanks,
mbouy

I’m having the same problem and dont know where to start…HELP!

Learning Knowitall: Start at the beginning and create your own thread - see here: http://forum.avast.com/index.php?topic=53253.0

ok will do thanks

Hi mbouy

Looks pretty good. Any problems or symptoms?

Let’s give MBAM another run and make sure the file was replaced.

Open MBAM

[*]Click the Update tab
[*]Click Check for Updates
[*]If an update is found, it will download and install the latest version.
[*]The program will close to update and reopen.
[*]Once the program has loaded, select “Perform Quick Scan”, then click Scan.
[*]The scan may take some time to finish,so please be patient.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Make sure that everything is checked, and click Remove Selected.
[]When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
[
]The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
[*]Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

[*]Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]When the window appears, underneath Output at the top change it to Minimal Output
[*]UNCheck the boxes beside LOP Check and Purity Check.
[*]In the window under Custom Scans/Fixes copy and paste the following

c:\windows\Installer{86441a1a-b8ae-7c8e-3a1e-269a24fc7afb} /s
/md5start
Services.*
/md5stop

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad windows, OTL.Txt no Extras.Txt this time.

Plose post back with
[]MBAM log
[
]OTL log

Hi Oldman,

I think it’s all clean, there’s been no further trouble. Attached are mbam and otl logs.

Thanks for your help.
mbouy