Trojan.Sirefef.HU

Discussion in 'Malware Help (A Specialist Will Reply)' started by Ebmocwen, May 10, 2013.

  1. Ebmocwen

    Ebmocwen Private E-2

    Hi :) I am running Windows XP. My antivirus software alerted me that it detected "Trojan.Sirefef.HU", but when I try to scan my drive, the av program crashes. It is provided by my ISP, Bell, (when it is running I see RPS.exe in Windows Task Manager).

    The only symptoms I really seem to notice are that Windows Explorer is very slow and crashes a lot, and I see my HD light on quite often, and when whatever it is that is accessing my drive is doing it's thing, my computer is very slow and unresponsive.

    While running through "Read and Run Me First", the av was still reporting the presence of the Trojan and I was still having the problem with Explorer.
    Thanks in advance! :)
     

    Attached Files:

    Ebmocwen, May 10, 2013
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:


    • [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\n) [-] -> FOUND
      [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\n) [-] -> FOUND
      [HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\n) [-] -> FOUND

    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.

    Now click the Files/folders tab and locate these detections:


    • [ZeroAccess][FILE] n : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\n [-] --> FOUND
      [ZeroAccess][FILE] n : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\n [-] --> FOUND
      [ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\@ [-] --> FOUND
      [ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\@ [-] --> FOUND
      [ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\U --> FOUND
      [ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\U --> FOUND
      [ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\L --> FOUND
      [ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\L --> FOUND
      [ZeroAccess][FILE] Desktop.ini : C:\WINDOWS\Assembly\GAC\Desktop.ini [-] --> FOUND

    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)

    Reboot and rescan with RogueKiller and attach that new log as well.

    Be sure to tell me how things are running now.
     
    TimW, May 11, 2013
    #2
  3. Ebmocwen

    Ebmocwen Private E-2

    Thank you for the quick reply!

    Forgive me for my low tech-edness, but I'm not sure I understand the direction.

    I ran RogueKiller v8.5.4 and clicked scan. When it finished I clicked on the registry tab. There I see five detections listed, and none of them seem to match the three detections you said to look for. Under the column heading "Global" I do see "HKLM" listed. Under the column heading "Key" I see what appear to be paths listed, but none of them start with "C:\RECYCLER\ ..." Are the parts you show inside [] to be found in the description?

    Under the "Files" tab, I see six detections listed, which match six of the nine detections you mentioned. I also note that there are no check boxes under this tab to check or uncheck the items listed. They all appear to be highlighted.

    Because I was unsure about the first step after scanning, I thought it safest to perform no action until I sought clarification.

    Again I apologize for my confusion and I appreciate the help!

    with thanks,
     
    Ebmocwen, May 11, 2013
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Attach a new RogueKiller log so I can see what you are referring to.
     
    TimW, May 12, 2013
    #4
  5. Ebmocwen

    Ebmocwen Private E-2

    I believe this is the log that got generated last
     

    Attached Files:

    Ebmocwen, May 12, 2013
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to rerun RogueKiller and delete these:
    Code:
    ¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\@ [-] --> FOUND
[ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\@ [-] --> FOUND
[ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\U --> FOUND
[ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\U --> FOUND
[ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\L --> FOUND
[ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\L --> FOUND
    Then run it again and attach both logs.
     
    TimW, May 13, 2013
    #6
  7. Ebmocwen

    Ebmocwen Private E-2

    Re-ran Rogue Killer and got report [3]

    Deleted specified items and Rogue Killer generated report [4]

    Re-ran Rogue Killer and got report [5]
     

    Attached Files:

    Ebmocwen, May 13, 2013
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks good. How are things running now?
     
    TimW, May 13, 2013
    #8
  9. Ebmocwen

    Ebmocwen Private E-2

    Well, the little glitch in Windows Explorer seems to be gone. My antivirus program is still reporting Trojans. I saw it name Trojan.Generic.8262153, Trojan.Sirefef.HU and Trojan.Sirefef.XL before it heaved a sigh and crashed. I noted the av reported the path to the file was something like "C:\RECYCLER ... " something something, if that helps?
     
    Ebmocwen, May 14, 2013
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Empty your recycle bin.
     
    TimW, May 15, 2013
    #10
  11. Ebmocwen

    Ebmocwen Private E-2

    Well, emptied recycle bin and AV is still making the same reports. It is actually saying it is placing what it finds in "quarantine", is it possible it is blocking those files from being touched? It crashes before it ever finishes so I can't ask it to delete what is in quarantine.

    The Windows Explorer crashing is back and I have noticed another oddity, don't know if it is related. I am unable to use websites that require cookies to be enabled in your browser. I can't sign in to Google, You Tube, hotmail, whatever. I get an error message saying I must have cookies enabled, or something similar, and of course cookies are enabled. It is the same story whether I use Firefox, Internet Explorer or Chrome. Also if I try to search from the search box on the Firefox Start Page nothing happens, but it will accept input from the search bar on the upper right. Do you think this is related to the Trojans?
     
    Ebmocwen, May 16, 2013
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Rerun the Read and Run First instructions and get me new logs.
     
    TimW, May 17, 2013
    #12
  13. Ebmocwen

    Ebmocwen Private E-2

    Here you go, sorry for the wait ...
     

    Attached Files:

    Ebmocwen, May 26, 2013
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:


    • [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\n) [-] -> FOUND
      [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\n) [-] -> FOUND
      [HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\n) [-] -> FOUND

    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.

    Now click the Files/folders tab and locate these detections:


    • [ZeroAccess][FILE] n : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\n [-] --> FOUND
      [ZeroAccess][FILE] n : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\n [-] --> FOUND
      [ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\@ [-] --> FOUND
      [ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\@ [-] --> FOUND
      [ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\U --> FOUND
      [ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\U --> FOUND
      [ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\L --> FOUND
      [ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\L --> FOUND
      [ZeroAccess][FILE] Desktop.ini : C:\WINDOWS\Assembly\GAC\Desktop.ini [-] --> FOUND

    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)

    Now reboot and rescan with RogueKiller and attach that new log as well.

    Be sure to tell me how things are running now.
     
    TimW, May 26, 2013
    #14
  15. Ebmocwen

    Ebmocwen Private E-2

    Under "Registry" tab I see one of the specified detections listed.
    Under the "Folder" tab I see six of the nine specified detections listed.
    How shall I proceed?
    I am attaching the RK log generated by this scan, but I have not performed any deletions.
     

    Attached Files:

    Ebmocwen, May 28, 2013
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:


    • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{08B891A3-ACB2-4277-A787-AA31A3A7E2DB}]

    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.

    Now click the Files/folders tab and locate these detections:


    • [ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\@ [-] --> FOUND
      [ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\@ [-] --> FOUND
      [ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\U --> FOUND
      [ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\U --> FOUND
      [ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-18\$bb7338b39902cee92e81ebad45e3ef06\L --> FOUND
      [ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-21-1556446600-808732675-1645027910-1006\$bb7338b39902cee92e81ebad45e3ef06\L --> FOUND

    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)

    Now reboot and rescan with RogueKiller and attach that log as well. Be sure to tell me how things are running now.
     
    TimW, May 28, 2013
    #16
  17. Ebmocwen

    Ebmocwen Private E-2

    I did not see this detection listed.


    I deleted these detections.

    I'll probably have to run the computer over the next few days and see how things go, but I tried a few sites like YouTube and don't seem to have that issue with cookies anymore.

    I ran my antivirus program and it completed a scan without crashing. It says it detected "17 infections", and that it has "21 files" in quarantine. I will attach it's log here to see if that helps you with any information?
     

    Attached Files:

    Ebmocwen, May 28, 2013
    #17
  18. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You will only be able to remove what your AV software found by toggling System Restore. Let me know how things are running.
     
    TimW, May 29, 2013
    #18
  19. Ebmocwen

    Ebmocwen Private E-2

    Do you mean that by toggling system restore off and on again, my AV should no longer report infected files? Or do you mean I need to toggle system restore, then do a scan and delete what it finds? Would the sequence be System Restore Off/On, then scan and delete, or System Restore Off, Scan and Delete, then System Restore On?
     
    Ebmocwen, May 30, 2013
    #19
  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Turn System Restore off. Reboot and turn it back on. Then scan.
     
    TimW, May 30, 2013
    #20
  21. Ebmocwen

    Ebmocwen Private E-2

    Done and done. No viruses detected. There were items in quarantine which I deleted. Things seem to be working pretty good now.

    Is there anything else I should do for final clean up?
     
    Ebmocwen, Jun 5, 2013
    #21
  22. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Jun 5, 2013
    #22
  23. Ebmocwen

    Ebmocwen Private E-2

    All done! As always thanks so much for the help!
     
    Ebmocwen, Jun 13, 2013
    #23
  24. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     
    TimW, Jun 13, 2013
    #24

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds