Sirefef/consrv.dll

Viruses and worms
1

My apologies if this ends up being posted more than once. I was having some trouble posting and can’t tell if my first try actually went through.

I got hit with Win 7 Security 2012, I managed to remove it and get my computer running normally again, but Avast keeps popping up to tell me it’s blocked a Trojan. Malware bytes doesn’t pick up anything but the when I scan with avast it finds 3 infected files all called consrv.dll. When I try to do anything in Avast to get rid of them I’m no longer able to start windows and am forced to do a system restore.

My logs are attached, really hope someone can help me. Thanks

2

and here is the disk management screenshot

3

Hi robingshore, welcome to the forum.

To make cleaning this machine easier
[*]Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
[*]Please do not run any scans other than those requested
[*]Please follow all instructions in the order posted
[*]All logs/reports, etc… must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
[*]Do not attach any logs/reports, etc… unless specifically requested to do so.
[*]If you have problems with or do not understand the instructions, Please ask before continuing.
[*]Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

[*]Right click on ComboFix.exe, click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer’s settings, including making I-E the default browser.
3.CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log.

Thanks

4

Thanks oldman!

I ran combofix and my log is attached. One thing to note: When it Combofix finished running it’s scan the computer froze and I was forced to manually reboot, can’t tell if this affected anything.

5

Hi robingshore,

How’s the computer? Any symptoms such as redirects?

6

Commputer seems to be doing fine now. I haven’t used it too much since running combofix, but I played around on the internet this morning for about 20 minutes and wasn’t having any issues. Anything I should do next to get the all clear?

7

Hi robingshore,

You have this program installed, Malwarebytes’ Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

[*]Click the Update tab
[*]Click Check for Updates
[*]If an update is found, it will download and install the latest version.
[*]The program will close to update and reopen.
[*]Once the program has loaded, select “Perform Quick Scan”, then click Scan.
[*]The scan may take some time to finish,so please be patient.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Make sure that everything is checked, and click Remove Selected.
[]When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
[]The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
[*]Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

One more to check for stragglers.

As a Vista/Win7 user you will need to right click your browser icon and select “Run as Administrator” in order to run this scan.
[]Do not use this instance of your browser for anything besides doing this scan
[]When the scan is complete and the results saved, close that instance of your browser
[*]Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don’t go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

[*]Tick the box next to YES, I accept the Terms of Use.
[*]Click Start
[*]When asked, allow the activex control to install
[*]Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
[*]Click Start
[*]Make sure that the option “Remove found threats” is Unchecked, and the option “Scan unwanted applications” is Checked.
[*]Click Scan.
[*]Wait for the scan to finish.
[*]When the scan completes, click List of found threats
[*]click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
[*]Include the contents of this report in your next reply

Note - when ESET doesn’t find any threats, no report will be created.

[*]Push the back button.
[*]Push Finish
[*]Re-enable your Antivirus software.

Please post back with
[]MBAM log
[]ESET log if there is one.
Everything still ok?

8

Malware bytes didn’t pick up any threats, but the eset scanned found a couple of things. Logs are attached.

I’m still not getting any weird pop-ups or redirects, but I was using Sony Vegas (video/audio editing software) on the computer earlier today and the program kept crashing and throwing up some error message about ntdll.dll… Not sure if that is related.

Thanks so much for all the help so far. Let me know what the next step is.

9

Hi robingshore,

The Eset detections are files we have all ready quarantined except for one, vlcmediaplayer. That is more of a warning detection based on the type of file it is. If you insalled the program i don’t think it’s a concern. The quarantined files will be removed when we remove the tools.

Is it only when you use Sony Vegas that you recieve the error message?