Trojan virus issue

Snowride155 · Jan 10, 2013

Hello all, I'm obviously new here. I received a message from my Windows 7 action center today saying that I had a Trojan:Win32/Sirefef.AN. I went through all the instructions in the READ & RUN ME FIRST post and obtained all the logs that were requested from RK, HitmanPro, and MGtools. No threats were detected when I ran TDSkiller or Malwarebytes. However the other programs did detect issues. I did not delete or quarantine anything per instructions. Here are the logs. Thank you very much in advance!

TimW · Jan 10, 2013

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-3174122918-4036108595-1348009327-1000\$2949d9e2503ad8af17f3f1800486e3b8\n) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.

Now click the Files/folders tab and locate these detections:

[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-21-3174122918-4036108595-1348009327-1000\$2949d9e2503ad8af17f3f1800486e3b8\n --> FOUND
[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-3174122918-4036108595-1348009327-1000\$2949d9e2503ad8af17f3f1800486e3b8\@ --> FOUND
[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-3174122918-4036108595-1348009327-1000\$2949d9e2503ad8af17f3f1800486e3b8\U --> FOUND
[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-3174122918-4036108595-1348009327-1000\$2949d9e2503ad8af17f3f1800486e3b8\L --> FOUND
[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND
[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Now rerun Hitman and have it fix everything it finds.

Reboot.

Re-scan with both RogueKiller and Hitman and attach those new logs as well.

Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:
* C:\MGlogs.zip
Make sure you tell me how things are working now!

Snowride155 · Jan 11, 2013

Thank you for being so detailed with that procedure. I followed the first set of instructions and ran RK. I selected only that registry detection and deleted it. After I did that I went to the files tab and all of those other detections you have written were deleted when the registry detection was deleted. Which I'm assuming is ok. My question is after I do the reboot and run RK again, which fix button do I select? Fix Host, Proxy, DNS, shortcuts, or Delete? Here is the 2nd RK log. Thanks again!

Snowride155 · Jan 11, 2013

I re-read your post and realized that I'm only supposed to run hitman and fix the issues that were found. So you can completely disregard my previous post. I have since performed all of those tasks. After the reboot and rescan using hitman, there were no threats detected. However when I ran RK there was a list of quite a few registry issues found. I have all three post-deletion logs that I just ran. Thanks again, Nick.

Snowride155 · Jan 11, 2013

Also to add to the problem I can no longer perform windows updates. I went into services.msc and there is no service for windows update. I'm assuming the virus took out my windows update agent.

TimW · Jan 11, 2013

Looks good. What issues do you still have, if any?

Snowride155 · Jan 11, 2013

Other than RK finding those registry issues I am not able to install any Windows updates. I think the virus must have attached itself to a registry item for windows update or something. I was able to find windows update in services.msc. It allows me to find the new Windows updates but when I try to install them it says failed.

TimW · Jan 12, 2013

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

Snowride155 · Jan 13, 2013

Perfect! It worked like a charm! Thank you very much for all of your help Tim. I ran security essentials after everything was sorted out. It found 2 items Exploit:Java/CVE-2012-4681 and 2013-0422. I deleted both items. Everything seems to be in tip top shape. Thanks again!

TimW · Jan 14, 2013

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

After doing the above, you should work thru the below link

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Log in or Sign up

Trojan virus issue

Snowride155 Private E-2

Attached Files:

HitmanPro_20130110_1148.log

GetUnKey.txt

RKreport[1]_S_01102013_02d1158.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Snowride155 Private E-2

Attached Files:

RKreport[2]_S_01112013_02d0018.txt

Snowride155 Private E-2

Attached Files:

RKreport[3]_S_01112013_02d0137.txt

HitmanPro_20130111_0141.log

MGlogs.zip

Snowride155 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Snowride155 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Snowride155 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member