[YWNA]

Hello,

about 3 days back, my free version of BitDefender total security 2013 detected trojan.sirefef.fy and trojan.Generic , both of which kept recurring at different locations despite attempting clean-up. It would detect this virus every single time i would start the laptop. I commonly saw:

C:\windows\assembly\GAC_64\Desktop.ini : Trojan.sirefef.fy
c:\windows\system32\smss.exe :Trojan.sirefef.fy
C:\windows\assembly\GAC_32\Desktop.ini : Trojan.generic. 7552xxx (some numbers)

I did the following steps and I have the logs:

1. Malwarebytes (didn't detect any infected files)
2. GMER
3. DDS
4. Bootkit Remover
5.aswMBR
6. TDSS Killer
7. FixTDSS
8. ComboFIX ( this step seemed to have had some positive effect)

I ran a complete system scan with BitDefender , and no viruses have been detected. No malicious files were detected with a Quick Scan with Malwarebytes too. My questions are:

1. Has my system been cleaned up of the dreaded virus?
2. If not , what steps may I take next? I saw some recommendations here for running OTL, but i wanted to double check with experts first
3. Are there any cleanups/restores I must do?

I can provide any logs required. Any help will be greatly appreciated! Thank you so much in advance.

[Advertisements]

Hello YWNA,
. My name is godawgs and I will be assisting you with your Virus / Malware issues.

I am currently still in training and my posts have to be approved by an expert so please expect a delay between my posts.

I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.
If you have not, please adhere to the guidelines below and then carefully follow all future instructions:

I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same.
Because of this, you must reply within four days. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
• Please let me know if you are using a computer with multiple accounts, as this can affect the instructions given.
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  I would recommend printing them out, if you can, so you can check off each step as you complete it.
  Also, part of the fix may require you to be in Safe Mode, which will not allow you to access the internet, or my instructions!
• If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!
• All tools must be run from an account with Administrator privileges.
• Do not do things I do not ask for, such as running a spyware scan on your computer, installing/uninstall programs, deleting files, modifying the registry or running any tools, unless instructed to do so. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date (if possible)!
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.
• Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
  In light of this be prepared to back up your data. Have means of backing up your data available.

In order to be notified when your topic has been replied to:

Click My Settings at the top of the page. An Option page will open. In the left hand column click Notification Options. On the new page that opens under the Notification Preferences section click Watch every topic I reply to and set the notification type to Immediate Notification.

I wanted to get to you ASAP to advise you not to download and run anymore tools unless you know what they are and exactly what they can do or have been asked by a malware removal helper to download and run them.

I did the following steps and I have the logs:

1. Malwarebytes (didn't detect any infected files)
2. GMER
3. DDS
4. Bootkit Remover
5.aswMBR
6. TDSS Killer
7. FixTDSS
8. ComboFIX ( this step seemed to have had some positive effect)

Did you have GMER, TDSSKiller of ComboFix make any fixes? I will need to see the logs, but depending on the infection you have (if any) these tools can harm the system if you don't know what they do.

The Bootkit Remover tool is an old program that hasn't been updated since sometime in 2011.
FixTDSS is a tool designed for the Backdoor.Tidserv infection so I'm not sure why you ran it for the Trojan.sirefef.fy infection. I would like to see that log also.

DDS and aswMBR are primarily diagnosis tools. I want to see the aswMBR log as well.

...I saw some recommendations here for running OTL, but i wanted to double check with experts first

Downloading and running OTL is the only recommendation you will see here to start the diagnosis and removal process.

We will start with an OTL scan, but depending on what infection you have and what the GMER, Bootkit Remover, TDSSKiller, FixTDSS and ComboFix tools have already done we may not be able to do very much.


Step-1.

OTL Custom Scan

Download OTL to the Desktop. It is important that it is download to the Desktop. (FireFox users should right click the download link and click "Save File As". On the window that comes up, make sure the download location is the Desktop and click the Save button.)

1. Please copy the text in the code box below and paste it in the box in OTL. To do that:

• Highlight everything inside the code box, right click the mouse and click Copy.

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
consrv.dll
wshelper.dll
/md5stop
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
C:\Windows\assembly\tmp\U\*.* /s
C:\Program Files\Common Files\ComObjects\*.* /s
DRIVES
>C:\commands.txt echo list vol /raw /hide /c
/wait
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
del c:\commands.txt^|y /hide /c
/wait
del c:\diskreport.txt^|y /hide /c

2. Open OTL on the desktop. To do that:

• Double click on the OTL icon to run it. Make sure all other windows are closed.
• You will see a console like the one below:
  
  
  
• Check the box beside Scan All Users at the top of the console
• Make sure the Output box at the top is set to Standard Output.
• Check the boxes beside LOP Check and Purity Check.
• Place the mouse pointer inside the box, right click and click Paste. This will put the above script inside OTL
• Click the button. Do not change any settings unless otherwise told to do so.
• Let the scan run uninterrupted.
• When the scan completes, it will open OTL.Txt on the desktop. The Extras.txt file will be minimized. These files is also saved in the same location as OTL (it should be on your desktop).
• Please copy the contents of these files and paste them into your reply. To do that:
• On the OTL.txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
• Right click inside the forum post window then click Paste.This will paste the contents of the OTL.txt file in the in the post window.

Repeat for the Extras.txt file


Step-2.

Things For Your Next Post:
1. The OTL.txt log
2. The Extras.txt log
3. The GMER log
4. The Bootkit Remover log
5. The TDSSKiller log
6. The FixTDSS log
7. The aswMBR log
8. The ComboFix log

Once I have reviewed the logs I will get back tp you.

[godawgs]

Hello YWNA,
. My name is godawgs and I will be assisting you with your Virus / Malware issues.

I am currently still in training and my posts have to be approved by an expert so please expect a delay between my posts.

I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.
If you have not, please adhere to the guidelines below and then carefully follow all future instructions:

I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same.
Because of this, you must reply within four days. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
• Please let me know if you are using a computer with multiple accounts, as this can affect the instructions given.
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  I would recommend printing them out, if you can, so you can check off each step as you complete it.
  Also, part of the fix may require you to be in Safe Mode, which will not allow you to access the internet, or my instructions!
• If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!
• All tools must be run from an account with Administrator privileges.
• Do not do things I do not ask for, such as running a spyware scan on your computer, installing/uninstall programs, deleting files, modifying the registry or running any tools, unless instructed to do so. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date (if possible)!
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.
• Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
  In light of this be prepared to back up your data. Have means of backing up your data available.

In order to be notified when your topic has been replied to:

Click My Settings at the top of the page. An Option page will open. In the left hand column click Notification Options. On the new page that opens under the Notification Preferences section click Watch every topic I reply to and set the notification type to Immediate Notification.

I wanted to get to you ASAP to advise you not to download and run anymore tools unless you know what they are and exactly what they can do or have been asked by a malware removal helper to download and run them.

I did the following steps and I have the logs:

1. Malwarebytes (didn't detect any infected files)
2. GMER
3. DDS
4. Bootkit Remover
5.aswMBR
6. TDSS Killer
7. FixTDSS
8. ComboFIX ( this step seemed to have had some positive effect)

Did you have GMER, TDSSKiller of ComboFix make any fixes? I will need to see the logs, but depending on the infection you have (if any) these tools can harm the system if you don't know what they do.

The Bootkit Remover tool is an old program that hasn't been updated since sometime in 2011.
FixTDSS is a tool designed for the Backdoor.Tidserv infection so I'm not sure why you ran it for the Trojan.sirefef.fy infection. I would like to see that log also.

DDS and aswMBR are primarily diagnosis tools. I want to see the aswMBR log as well.

...I saw some recommendations here for running OTL, but i wanted to double check with experts first

Downloading and running OTL is the only recommendation you will see here to start the diagnosis and removal process.

We will start with an OTL scan, but depending on what infection you have and what the GMER, Bootkit Remover, TDSSKiller, FixTDSS and ComboFix tools have already done we may not be able to do very much.


Step-1.

OTL Custom Scan

Download OTL to the Desktop. It is important that it is download to the Desktop. (FireFox users should right click the download link and click "Save File As". On the window that comes up, make sure the download location is the Desktop and click the Save button.)

1. Please copy the text in the code box below and paste it in the box in OTL. To do that:

• Highlight everything inside the code box, right click the mouse and click Copy.

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
consrv.dll
wshelper.dll
/md5stop
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
C:\Windows\assembly\tmp\U\*.* /s
C:\Program Files\Common Files\ComObjects\*.* /s
DRIVES
>C:\commands.txt echo list vol /raw /hide /c
/wait
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
del c:\commands.txt^|y /hide /c
/wait
del c:\diskreport.txt^|y /hide /c

2. Open OTL on the desktop. To do that:

• Double click on the OTL icon to run it. Make sure all other windows are closed.
• You will see a console like the one below:
  
  
  
• Check the box beside Scan All Users at the top of the console
• Make sure the Output box at the top is set to Standard Output.
• Check the boxes beside LOP Check and Purity Check.
• Place the mouse pointer inside the box, right click and click Paste. This will put the above script inside OTL
• Click the button. Do not change any settings unless otherwise told to do so.
• Let the scan run uninterrupted.
• When the scan completes, it will open OTL.Txt on the desktop. The Extras.txt file will be minimized. These files is also saved in the same location as OTL (it should be on your desktop).
• Please copy the contents of these files and paste them into your reply. To do that:
• On the OTL.txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
• Right click inside the forum post window then click Paste.This will paste the contents of the OTL.txt file in the in the post window.

Repeat for the Extras.txt file


Step-2.

Things For Your Next Post:
1. The OTL.txt log
2. The Extras.txt log
3. The GMER log
4. The Bootkit Remover log
5. The TDSSKiller log
6. The FixTDSS log
7. The aswMBR log
8. The ComboFix log

Once I have reviewed the logs I will get back tp you.

[YWNA]

Hi GoDawgs,

please close this topic for now. My office sys admin is taking a look at it and they've provided me with a back-up laptop. I'll let you know if it needs to be reopened! Thank you so much for your detailed and prompt response. Just feel bad that I wasted your time!

[godawgs]

Just feel bad that I wasted your time!

Not at all.
We provide help mainly to individual users but we have been known to help on a company computer if the company's IT department is aware of it and agrees to having us help. We don't ever want to take their place or work on their computers without their knowledge and approval.

So you did the right thing by notifying the Sys. Administrator.
Best of luck.

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.