Win32:Sirefef-PL [Rtf]

Aaron Smith · Jul 12, 2013

Hi everyone,

First of all many thanks to whoever takes the time to look into this for me.

I believe I have followed, to the letter, all the appropriate Sticky Threads on the forum but unfortunately am still having problems.

I apologise for not being complete au fait with what is actually going on but I am rather computer literate so hopefully I can do whatever you guys need me to so I can get this issue fixed.

I believe my computer is infected with a virus/malware known as "Win32:Sirefef-PL [Rtf]" - Around 3 months ago Avast gave me a message surrounding this and it dealt with it, I presumed that would be it done and dusted but over the last few days it has continually came up again and a Google search quickly revealed that I need help!

When I login every time Avast gives me the same warning and it shows the virus location as being "C:\$Recycle.Bin\....................."

The various logs I have attached seem to show this directory as well so it seems this could be where the virus/malware is. I am aware from the reading I have done on Google however that this virus/malware is a lot more intelligent than just being idle in one place but none the less I am hoping you experts can help me out.

Many thanks and if you need any further information just let me know.

Aaron

Kestrel13! · Jul 13, 2013

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these 4 detections:

[RUN][SUSP PATH] HKCU\[...]\Run : SearchProtect (C:\Users\Aaron Smith\AppData\Roaming\SearchProtect\bin\cltmng.exe [7]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-21-3938699062-1592124114-1935566642-1000\[...]\Run : SearchProtect (C:\Users\Aaron Smith\AppData\Roaming\SearchProtect\bin\cltmng.exe [7]) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\Aaron Smith\AppData\Local\{8ad92004-9e34-f826-dcae-f5206536cc82}\n. [x][x]) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-3938699062-1592124114-1935566642-1000\$8ad920049e34f826dcaef5206536cc82\n. [-]) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.

...and the same for items on the file/folder tab please:

[ZeroAccess][File] @ : C:\Windows\Installer\{8ad92004-9e34-f826-dcae-f5206536cc82}\@ [-] --> FOUND

[ZeroAccess][File] @ : C:\Users\Aaron Smith\AppData\Local\{8ad92004-9e34-f826-dcae-f5206536cc82}\@ [-] --> FOUND

[ZeroAccess][Folder] U : C:\Windows\Installer\{8ad92004-9e34-f826-dcae-f5206536cc82}\U [-] --> FOUND

[ZeroAccess][Folder] U : C:\Users\Aaron Smith\AppData\Local\{8ad92004-9e34-f826-dcae-f5206536cc82}\U [-] --> FOUND

[ZeroAccess][Folder] L : C:\Windows\Installer\{8ad92004-9e34-f826-dcae-f5206536cc82}\L [-] --> FOUND

[ZeroAccess][Folder] L : C:\Users\Aaron Smith\AppData\Local\{8ad92004-9e34-f826-dcae-f5206536cc82}\L [-] --> FOUND

[ZeroAccess][Junction] en-US : C:\Program Files\Windows Defender\en-US >> \systemroot\system32\config [-] --> FOUND

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Now rerun Hitman and have it delete items under the headings: Malware, Malware remnants and Potential Unwanted Programs.

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

After reboot, check to see if your firewall is working.

Rerun RogueKiller and Hitman again (just scans this time, no fixes) and attach logs from those please.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

Aaron Smith · Jul 14, 2013

Ok, so I have encountered some problems

When I followed your steps on Rogue Killer I got the 4 registry files and deleted them as instructed, there was nothing at all under the “files” tab though so I haven’t been able to do anything there?

I re-ran Hitman and followed the instructions which seemed to work fine.

I downloaded Windows Repair and followed the instructions on that also.

I’ve re-ran and attached the logs from Rogue Killer and Hitman again for you. I have also attached the new MGlogs.zip file for you as well.

The computer is still running in the same manner with the occasional popup about this virus/malware appearing.

Thanks, Aaron

Kestrel13! · Jul 15, 2013

http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

Please save the work in your browsers before proceeding.

Double-click JRT.exe to run (Vista/7 right-click and select Run as Administrator)

The tool will open and start scanning your system.

Please be patient as this can take a while to complete.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Please attach JRT.txt to your next message. (See: HOW TO: Attach Items To Your Post )

Now one more scan with RogueKiller please and attach log.

Aaron Smith · Jul 15, 2013

Ok, I have followed those instructions and attached the logs

I also meant to say in my last message that I tried to check my firewall and when I opened it in control panel it showed green ticks so I presume this means it is working? I also checked Windows Defender and noticed a problem. There was a message showing “A problem caused this program’s service to stop. To start the service, click the Start now button or restart your computer” I tried clicking the start now button but received a critical error popup which said “The specified service does not exist as an installed service. (Error code: 0x80070424)

Thanks

Aaron

Kestrel13! · Jul 16, 2013

Apart from Windows Defender is everything running well malware wise? I may refer you to the software forum to resolve the outstanding issues with Windows Defender.

Aaron Smith · Jul 16, 2013

Kestrel13! said: ↑

Apart from Windows Defender is everything running well malware wise? I may refer you to the software forum to resolve the outstanding issues with Windows Defender.
Click to expand...

The computer seems to be running a bit quicker but I got another avast popup this morning alerting me to the same virus with the same path as before.

Kestrel13! · Jul 16, 2013

http://img827.imageshack.us/img827/1263/frst.gif For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

Aaron Smith · Jul 17, 2013

Hi,

I am at work at the moment so will follow these steps this evening when I am home from work.

I have just had a rather worrying call from MBNA however, someone has tried to login unsuccessfully to my MBNA account at their online card services website. MBNA have suspended all my accounts and I have now resolved this but I am rather concerned that perhaps as well as this malware it has placed a keylogger on my computer (which I have read about on here)

Do any of the scans we are doing check for this and if not is there anything we can do to check for this?

Thanks in advance and I will post the results of the latest guidance tonight.

Aaron

Aaron Smith · Jul 17, 2013

Hi,

As discussed I have followed the instructions you gave and have attached the requested log as requested.

I have also (since my earlier post) went ahead and updated all of my passwords that I can think of based on the telephone call from MBNA.

I am not sure whether I have a keylogger of some form that has been embedded into my computer also but until I hear back from you I don’t intend on doing any internet banking and such like.

I hope there is a way you can help with this also, I believe it is an associated issue.

MBNA have advised me that I need to destroy all my cards, get new ones and then re-register for their online service due to the risk that my security on the current cards has been compromised.

I will await to hear from you.

As always, thanks

Aaron

Kestrel13! · Jul 17, 2013

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Reboot the machine, then rerun FRST, just a scan and attach the log please.

Aaron Smith · Jul 19, 2013

Hi,

I have followed your instructions and attach the relevant log

I look forward to hearing back from you.

Thanks

Aaron

Kestrel13! · Jul 19, 2013

Rescan with FRST and attach log.

Aaron Smith · Jul 19, 2013

Hi,

Sorry - I've no idea how I missed that part of the instruction.

Attached now.

Aaron

Kestrel13! · Jul 19, 2013

That's ok. Describe how things are running?

Aaron Smith · Jul 20, 2013

Nothing jumping out at me anymore to tell me about a virus on my machine which I suppose can only be a positive.

I don't know how it actually got into my machine in the first place though as I've got a virus protector and I had malware bytes on my computer before this.

Is the virus/malware now fully gone?

I'm still rather concerned about the keylogger aspect?

Kestrel13! · Jul 20, 2013

It is of my opinion that you are clean now. Is your antivirus complaining about anything anymore?

Aaron Smith · Jul 21, 2013

It doesn't appear to be. I will run an avast scan through the day and a malware bytes scan through the day to see if anything crops up.

Is it safe to say that the infection I have had has likely planted a keylogger on my machine and that's how I have suffered the issue with my MBNA accounts?

Thanks

Aaron

Kestrel13! · Jul 21, 2013

I am not seeing any evidence of a keylogger here.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Aaron Smith · Jul 23, 2013

Kestrel,

Sorry for the delay in getting back to you, the thorough avast scan and the malwarebytes scan took a bit of time for some reason.

I've attached the logs to both (I'm not sure if you are familiar with the avast logs) but it seems there are still problems, albeit I'm not sure if they are related?

Kestrel13! · Jul 23, 2013

What Avast is hitting on are not threats from what I can see. Apart from this is there anything else you would like to ask about?

Aaron Smith · Jul 26, 2013

Kestrel13! said: ↑

What Avast is hitting on are not threats from what I can see. Apart from this is there anything else you would like to ask about?
Click to expand...

No this is my only final concern, what is Avast picking up on then? When the scanner is actually popping up these issues it is showing them as Trojan viruses with varying variables in the malware/virus type?

Kestrel13! · Jul 26, 2013

It's picking up on Picasa and Nero etc...which you can see are not problems.

Aaron Smith · Jul 27, 2013

I see... I thought perhaps a virus or malware had embedded itself into that folder if that makes sense?

So it is fine to follow your "final steps" post and resume using my computer?

Kestrel13! · Jul 27, 2013

Yes, they are just false positives from what I can see.

Aaron Smith · Jul 28, 2013

Thanks. That's me followed your "closure" instructions.

Is there something we can do to look at the windows defender issue?

Kestrel13! · Jul 28, 2013

You can ask about it in the software forum.

Aaron Smith · Jul 28, 2013

Kestrel13! said: ↑

You can ask about it in the software forum.
Click to expand...

Thank you Thank you Thank you! :-D

Kestrel13! · Jul 28, 2013

No problem, safe surfing!

Win32:Sirefef-PL [Rtf]

Aaron Smith Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Aaron Smith Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

Aaron Smith Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Aaron Smith Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member