topic Re: Help with ZeroAccess/Sirefef infection in Norton Internet Security / Norton AntiVirus

Help with ZeroAccess/Sirefef infection

jackalbins — Sun, 13 May 2012 19:27:53 GMT

I hope I didn't discover this invaluable resource too late. I was recently infected with some version of the ZeroAccess or Sirefef Rootkit and have spent the last day or so trying to find a solution. My Norton Security Suite 5.0 through Comcast informed me that manual removal was required of afd.sys.vir (Trojan.Zeroaccess!inf2).

I'm running XP Media Center 2002 w/SP3. I just installed the Norton software when Microsoft Security Essentials alerted me to the infection, about the time I started to lose control of my browsers. It quarantined two instances each of Sirefef.P, Sirefef.AH, and Sirefef.AC.

After doing insufficient research, the first thing I did was run the ESET Sirefef Remover. That seemed to take care of most of the browser behavior. But Norton, which I then installed, was still detecting it, and GMER was showing a lot of SSDT activity. So parts of it seem to still be there.

I ran NPE, which detected nothing, as well as the FixZeroAccess program from Norton. Upon restart, it did detect an infection, but my computer froze as I was re-enabling System Restore, and before I could tell the removal tool to fix it. After reboot, I tried the remover again, and this time it ended up finding no infection. I haven't made any additional changes to the system since this happened. I did run TDSSKiller, and it found nothing.

On a side note, I have downloaded a few free or demo malware scanners to see what they could find. The SpyHunter Demo finds infections by Lop.com and Alexa which Norton, Hitman, and Malwarebytes do not - of course it doesn't allow me to fix them until I buy the full version.

If anyone could walk me through the best way to try to clean my computer, I would greatly appreciate it. And if someone could offer an explanation for why SpyHunter is the only software I've tried that has picked up these other infections, I would be grateful for that as well.

Thanks!

Re: Help with ZeroAccess/Sirefef infection

Niko233 — Sun, 13 May 2012 19:43:17 GMT

May be the AntiZeroAccess tool from Webroot AV and HitManPro can help you:

http://blog.webroot.com/2011/08/03/new-tool-released-kiss-or-kick-zeroaccess-goodbye/

http://www.surfright.nl/en/downloads/

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 01:50:14 GMT

One of the tools is out of date, I have just tried.

Quads

Re: Help with ZeroAccess/Sirefef infection

jackalbins — Mon, 14 May 2012 01:57:34 GMT

Haven't tried AntiZeroAccess yet, since I saw advice in this forum not to run anything until you figure out what you're dealing with.

HitManPro only turned up tracking cookies -- quite suspicious it seems to me. I'm guessing the infection is managing to hide evidence of its existence from just about everything.

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 02:27:39 GMT

You have a problem, You have used advanced tools that users are not to without supervisoin and also installed programs that can conflict

Quads

Re: Help with ZeroAccess/Sirefef infection

jackalbins — Mon, 14 May 2012 02:54:33 GMT

I've recently realized this, though nothing I'd read before I discovered this forum indicated that I was at risk of messing things up more, or that I needed supervision. I should have been more careful though.

What do I do at this point? Try a bootable cd? Your counsel is urgently needed.

Thanks.

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 03:01:24 GMT

Find the text files "combofix.txt" usually located C:\combofix.txt, there may be more than one log,

Attach the log(s) back here.

Quads

Re: Help with ZeroAccess/Sirefef infection

jackalbins — Mon, 14 May 2012 04:13:20 GMT

I ran ComboFix and generated the attached log file.

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 04:18:50 GMT

Where is the other logs, I did not say to run Combofix just then I just what that logs all of them.

Quads

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 04:26:38 GMT

Actually that is clever, Norton is not your main AV, you have just installed it, your Main AV is MSE, this is not the forum for MSE and all the other programs.

Quads

Trojan.ZeroAccess Fix

Jeevith — Mon, 14 May 2012 07:18:38 GMT

Run Sigverif,Replace the .sys File which are not Digitally Signed By Using the command Prompt in i386 folder.

Do Not Replace If (Netbt.sys,afd.sys,Ipsec.sys)

You Will Lose Your internet connection,Still Even You Replace the Infected File Back to the Drivers Folder you will Not Get the internet connection and Then It Goes to OS Reinstallation.

You Need Not Relay on Other Tools.You Fix it manually By This Way I have Worked Out In So Many Cases.

Re: Trojan.ZeroAccess Fix

Quads — Mon, 14 May 2012 07:31:06 GMT

That is bad advice for people reading this

"Do Not Replace If (Netbt.sys,afd.sys,Ipsec.sys)" OK keep the infection no problem

There are other tools creaded by AV response groups and other malware removal people to fix this with scans as long as you realise what you are dealing with first by logging.

The instructions are flawed, and don't work for a lot of the variations on x86 and x64 systems the last few threads on the forum this wouldn't have worked at all.

This is not your thread and the instructions won't work for this one either, due to the file involved.

Quads

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 07:36:20 GMT

Jack

Did you find the other logs??

Quads

Re: Help with ZeroAccess/Sirefef infection

jackalbins — Mon, 14 May 2012 13:32:44 GMT

This was the only log located on c:/

Re: Help with ZeroAccess/Sirefef infection

jackalbins — Mon, 14 May 2012 13:47:55 GMT

When my old Norton subscription expired I decided to try MSE, not more than a few days ago. After the infection, I remembered I could get Norton back from Comcast, and so installed it hoping the software would be more effective at dealing with the issue, not realizing what I was dealing with. Since I never received the usual notifications that the two security suites conflict, I kept MSE installed because I didn't want to lose its results.

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 20:12:21 GMT

Please do not run any tools unless instructed to do so.

We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

Please read every post completely before doing anything.

Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )
Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!

Please read carefully

a) Look up and write down the detections in the quarantine or history for MSE, the file(s) and locations taken from for Sirefef.P, Sirefef.AH, and Sirefef.AC.

b) then Uninstall Spyhunter and MSE to hopefully reduce the conflicts.

Quads

Re: Help with ZeroAccess/Sirefef infection

jackalbins — Mon, 14 May 2012 23:40:18 GMT

Let me know whether I should use MSE to remove these before I uninstall it, since I only had them quarantined (I assume you don't want me to touch them):

Sirefef.P: file:C:\WINDOWS\Temp\nav1BFB.tmp->[Obfuscator.PN] (MSE now says it can't find.)

Sirefef.P:

containerfile:C:\System Volume Information\_restore{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP876\A0087955.exe
file:C:\System Volume Information\_restore{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP876\A0087955.exe->[Obfuscator.PN]

Sirefef.AH:

containerfile:C:\WINDOWS\System32\ini910u.dll
containerfile:C:\WINDOWS\System32\UimBus.dll
file:C:\WINDOWS\System32\ini910u.dll->EWS->1.cod
file:C:\WINDOWS\System32\UimBus.dll->EWS->1.cod

Sirefef.AH:

containerfile:C:\WINDOWS\System32\ini910u.dll
containerfile:C:\WINDOWS\System32\plugplay.dll
file:C:\WINDOWS\System32\ini910u.dll->EWS->1.cod
file:C:\WINDOWS\System32\plugplay.dll->EWS->1.cod

Sirefef.AC:

file:C:\WINDOWS\System32\ini910u.dll
file:C:\WINDOWS\System32\UimBus.dll

Sirefef.AC:

file:C:\WINDOWS\System32\ini910u.dll
file:C:\WINDOWS\System32\plugplay.dll

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 23:46:39 GMT

Just Uninstall MSE as is. without trying the infection removal.

Quads

Re: Help with ZeroAccess/Sirefef infection

jackalbins — Mon, 14 May 2012 23:53:01 GMT

Okay, SpyHunter and MSE have been successfully uninstalled.

Re: Help with ZeroAccess/Sirefef infection

Quads — Mon, 14 May 2012 23:56:35 GMT

Please read carefully

Please download aswMBR hxxp://public.avast.com/~gmerek/aswMBR.exe to your desktop. (replace the hxxp with http)
Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT / Yes
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and Please attach the log in the post back, Don't have the program fix anything.

Quads