I have a nasty sirefef infection on my pc. I have sirefef.a in services.exe , so everytime MSE tries to clean it up, windows gets a critical error and neets to reboot, after which services.exe magically respawned. So I disabled MSE’s real time protection.
I also have sirefef.AB , .AN , .W and .P (as far as MSE knows) . I had a sirefef infection before, and I managed to remove it, but now it suddenly came back, I guess it wasn’t completely gone last time.
Here are my logs, any help to get rid of this pest would be hugely appreciated. Also, aswMBR BSOD’d whilst scanning. I’ll try and run it again.
It’s not supposed to, but it randomly enabled those proxies. I think it is one of the sirefef’s changing my proxy settings, so it can redirect me to add-filled websites. Although that hasn’t happened for a couple of months, I managed to fix it.
It probably changed it again, now that sirefef suddenly came back from the dead. Also, if I try to change it, a couple of minutes later it’s back on using that proxy.
Ok thats fine. We can fix that up. While you are trying to get aswMBR (if you can’t that is fine just let me know) to run I need to give you this warning…
WARNINGUnfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.
Unfortunately I have found what is known as the ZeroAccess rootkit on your system. It is an especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end we may need to reinstall the operating system anyway depending on the extent of the infection.
If you would like to format and reinstall your Operating System please let me know and we can assist you with that.
If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help.
If you get aswMBR to run attach that log. If not, let me know and we can continue.
I’d like to try and clean everything up first. I don’t feel like losing all the data on my HDD. Luckily I haven’t really entered any sensitive information on this pc. aswMBR is scanning as I speak, and it got further than last time without BSOD’ing, so I guess last time was just unfortunate coincidence.
If it so happens that I need to reinstall windows, I can do that on my own .
Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
If you are running Malwarebytes 1.6 or better, please disable it for the duration of this run.
To disable Malwarebytes
[*]Open the scanner and select the Protection tab
[*]Remove the tick from “Start Protection Module with Windows” as seen below
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot when it is done
[*]Then run a new scan and post a new OTL log ( don’t check the boxes beside LOP Check or Purity this time )
I see that you had downloaded ComboFix before?
Please delete the current version of Combofix.exe from your desktop and download a new version from here to your desktop.
Disable your AntiVirus and AntiSpyware applications.
Right-click and Run as Administrator on the Combofix.exe and follow the prombts on your display. When finish, it will create a C:\Combofix.txt. Please post this log for further review.
In your next reply please attach the logs made by OTL and ComboFix.
Okay. So here are the logs.
Also, combofix seems to have removed and fixed all the files MSE said where infected, plus some more files. And MSE is giving me the green light again .
[*] Extract the contents of the zipped file to desktop.
[*] Right-click and Run as Administrator GMER.exe. If asked to allow gmer.sys driver to load, please consent .
[*] If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
[] In the right panel, you will see several boxes that have been checked. Uncheck the following …
[] IAT/EAT
[] Drives/Partition other than Systemdrive (typically C:)
[] Show All (don’t miss this one)
[*] Then click the Scan button & wait for it to finish.
[*] Once done click on the [Save…] button, and in the File name area, type in “Gmer.txt” or it will save as a .log file which cannot be uploaded to your post.
[*]Save it where you can easily find it, such as your desktop, and attach it in your reply.
Caution
Rootkit scans often produce false positives. Do NOT take any action on any “<— ROOKIT” entries.
It didn’t find anything, so the log is completely empty. But here it is anyway .
Also, almost all the options were grayed out by default, except for services, registry, files ADS and the option to select the drives.
[*]Extract it to your desktop
[*]Double click TDSSKiller.exe
[*]when the window opens, click on Change Parameters
[*]under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
[*]click OK
[*]Press Start Scan
[*]Only if Malicious objects are found then ensure Cure is selected
[*]Then click Continue > Reboot now
[*]Attach the log in your next reply
[*]A copy of the log will be saved automatically to the root of the drive (typically C:)
[*]Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
[*]Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
[*]ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
[*]When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix’s window while it is running. That may cause it to stall.
. here is the log:
.