Trojan:Win32/SirefefAA

[Prophecy99]

I was infected with the nasty trojan last night. I thought I was installing a different program, and once I clicked on the extracted .exe file, that was it, the file dissapeared in front of my eyes and the infection started.

Win32 / SirefefAA

.

What can I do..?? i searched for manual removals all over online and it seems to be bogus directions with dead ends and utimately suggestions to pay some one like this link --> URL removed by moderator On the infected computer if you search for manual removals like this on line and click these links pertaining to its removal it redirects you to a weird ab.com site. Very smart nasty thing on my hands.

I ran full scans of Malwarebytes, Microsoft Security Essentials, Microsoft Safety Scan last night on safemode/with networking (a few times actually). They all found quite a few items each time. Once the items were cleans all programs wanted to restart to finalize the cleaning. After a restart I went to a normal boot up it eventually was detected with in 5 mins on Microsoft Security Essentials, and cleaned and asked to restart. That last detection is an endless loop of cleaning and detections as it keeps renaming it self. as a side note Was it bad to run multiple removal programs at once?

This trojan reinstates it self over and over and over again with different names in similar locations. Right now I have internet disabled, on a regular start up and as soon as MSE is done cleaning a new found infection, before I even hit ok clean successful please restart to finalize, I get a new infections of essentially the same thing.

I have removed a few very very nasty problems in the past, including the one that removes your start menu and icons desktop background etc on this same machine. So i feel like I can tackle this sob. Here is a post from windows about it

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FSirefef.AA

Please help me get my safety back. Thanks in advance

Edited March 24, 2012 by Maurice Naggar

[Prophecy99]

WINDOWS XP PRO SP 3

[Maurice Naggar]

Hello prophecy99 and welcome to Malwarebytes forum.

Let me suggest, if you're an MBAM customer, you contact the help desk at support@malwarebytes.org

Alternatively, Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Follow this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Please post there the contents of MBAM scan log & the DDS logs

Don't post your logs here.

[Prophecy99]

I want to state what I have done so far to spread the word if anyone searches this thread and needs help on this very severe and nasty sob.

Update: Day 3 2nd Morning

Completed last "safe mode" scan via Boot CD of Windows Defender Offline Beta, found nothing as suspected.

Restarted first normal log in onto windows since running numerous full scans one at a time during day 2. Using a restart in safemode w/ networking (8-10 restarts back to back in safemode) for each Full Scan.

List of Full Scans Run In Safemode One by One-

Malwarebytes // Microsoft Securtiy Essentials // Microsoft Safety Scanner // Superantispyware // Hitman Pro Trial Version // TDSS Killer // Eset Online Scanner // Kaspersky Virus Removal Tool // Windows Defender Offline Beta

Disc Cleanup & Registry Clean up were performed in CCleaner at first normal start up. Updated MSE, and Malwarebytes. MSE shows protected green "light" status, and does not show original symptoms of finding new renamed infections occuring approx every 6 mins or so after cleaning them or requesting restarts to complete the cleaning. Now on to the other first upated scan of Malwarebytes in regular mode, suprizingly enough found 4 infections(which IIRC was the same amount (not same 4 items) found in one of the previous scans on day 2) and removed successfully which interestingly didnt require a restart as many many attributies of this trojan from the getgo required full removal for.

Four Items found in Malware quick scan all titled - "Rootkit.Zeroaccess"

Monitoring System now which seems... up to par, still skeptical after such a monster epic event occured.

at this point I believe some of the full scans in safemode did the trick. Specifically TDSS root killer, ESET Online scanner, and Kaspersky all found numerious individual results and all removed successfully. The machine is working at a respectful rate and processor cpu speed seems to be at par (2.5 GB ram)

[Firefox]

Hello and welcome to Malwarebytes

I understand that you believe that you have removed all infections. Rootkit.Zeroaccess is a hard one to remove completely. I myself would feel safer if I had one of the experts take a look at your log files to make sure its gone completely. Please do not run any more tools especially cleaners as this will make it harder to diagnose and clean the computer.

Since you were/are infected, here are the steps needed to get your computer cleaned....

Please read the following so that you can begin the cleaning process:

Don't use any temporary file cleaners unless requested - this can cause data loss and make recovery difficult

You have 3 Options that you can choose from as listed below:

• Option 1 —— Free Expert advice in the Malware Removal Forum
  
• Option 2 —— Paying customer -- Contact Support via email
  
• Option 3 —— Premium, Fee-Based Support

OPTION 1

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the

Malware Removal forum so a qualified helper can help you fix any malware related problems/infections you may have.

• Please read and follow the directions >>Right HERE<<, skipping any steps you are unable to complete.
  
• After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification,
  so that you're alerted when someone has replied to your post.

NOTE: Please do not post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies.

If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
  Or
  
• You may send a Private Message to a Moderator asking for assistance.
  

OPTION 2

Alternatively, as a paying customer, you can contact the help desk by filling out the form located >>Right HERE<<

OPTION 3

If you would like to use our Malwarebytes Premium Services, Comprehensive solutions to all your computer support needs—from installation and set-up to troubleshooting and tune-ups go to our Malwarebytes Premium Services support site --> >>Right HERE<<

Please be patient, someone will assist you as soon as possible.

PS: Please use the "Reply to this topic" button not the Reply button when you start replying.

[Maurice Naggar]

A couple of points here, for the benefit of others reading this thread.

1) Avoid using registry cleaners. Otherwise you run the risk of turning your system non-startable.

Review the following discussion for more detail:

"Should I Use a Registry Cleaner?" http://aumha.net/viewtopic.php?t=28099

2) Especially in cases where ZeroAccess is involved, do not run disk cleanup or any temp file cleaner up-front before removing the main infectors.

Address removing the malware itself first. Leave the temp-file-cleaning for very last.