Infested with Sirefef-ZT Trojan

[chanwhk]

My Windows 7 has just infested with Sirefef-ZT trojan detected by avast
And I couldn't find any cure online.
Is there any tools available to delete this?

The file it's affecting is c:\Windows\System32\service.exe   if i remembered it correctly

Thanks

[adotd]

Hi chanwhk,

Welcome to the forum

Follow this guide and attach the logs.....not copy and paste. http://forum.avast.com/index.php?topic=53253.0

AdwCleaner
Mawarebytes
OTL
aswMBR
Farbar service scanner

Anthony

[mchain]

hi chanwhk,

services.exe is a necessary windows system file.  It is needed even if it is infected, so do not delete it, quarantine it, or rename it in any way, shape, or form.

Running the programs recommended by adotd is the proper way to go, as is attaching the resulting logs in your next reply.  That way, no damage should ever occur to your system.

[chanwhk]

ok. I'm going through the list now.
More of different types of Malware seems to have appears after the sirefef zt

[chanwhk]

This is the full system scan log with Malwarebytes

[mchain]

ok. I'm going through the list now.
More of different types of Malware seems to have appears after the sirefef zt

Yes.  Unfortunately, that is par for the course.  Rootkits are often designed to download additional malware, the more the better.  Ugh!

You might want to consider using another computer until this one is given the all clear.  Maximize cleansing time, and reduce the chance of re-infection while the cleansing is ongoing.

[b]EDIT:[/b]  Use "Attachments and other options" below the reply text box to attach your resulting logs.  Will save you a considerable amount of time and work to get this done.  Click that link below to open, then attach your logs.  It is much easier than copy/paste operation.  Only takes a second or two to perform.

[chanwhk]

ok. I'm going through the list now.
More of different types of Malware seems to have appears after the sirefef zt

Yes.  Unfortunately, that is par for the course.  Rootkits are often designed to download additional malware, the more the better.  Ugh!

You might want to consider using another computer until this one is given the all clear.  Maximize cleansing time, and reduce the chance of re-infection while the cleansing is ongoing.

Using a laptop now and disconnected internet connection on my desktop
AdwCleaner keep crashing on me.  For both search and delete.
Doing OTL now

[mchain]

AdwCleaner is one of many anti-malware tools your malware cleaning expert has access to.  Would not worry overmuch about AdwCleaner crashing atm.  This issue may well be addressed when your expert comes in to assist you.

[chanwhk]

OTL LOG is here

Scanning with aswMBR now

[chanwhk]

aswMBR log is here

I ran it in windows 7 but it gave me blue screen of death
so I ran it in safemode

[chanwhk]

Farbar service scan log

[chanwhk]

Finally gotten all the logs done, hopefully someone can help me on this.

[mchain]

Good job there.  Malware expert has been notified.

And now we wait.

[magna86]

Monitoring 

[magna86]

@chanwhk

Hello and Wellcome 
Your computer is full with crapware softwere and is infected with ZeroAcces Rootkit.

• I will be working on your Malware issues this may or may not solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• If you don't know or understand something, please don't hesitate to ask.
  
• Please refrain from making any further changes to your computer (Install/Uninstall programs, delete files, edit the registry, etc...)
• Please DO NOT run any other tools or scans whilst I am helping you.
  
• It is important that you reply to this thread. Do not start a new topic.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• Absence of symptoms does not mean that everything is clear.

--------------------------------


  Step#1 

Please download zoek.exe and save it to your desktop.

• Close any open browsers.
•   Temporarily disable your AntiVirus program. (If necessary)
  If you are unsure how to do this please read this or this Instruction.
  
  
  
  
• Double click on zoek.exe to run the tool .
  Please wait while the tool does not start...
  
  
• Select "Combined fix"options    (bottom right)
  
  
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:

Code: [Select]


startupall;
C:\Windows\assembly\GAC_32\Desktop.ini;f
C:\Windows\assembly\GAC_64\Desktop.ini;f
filesrcm;
{D4027C7F-154A-4066-A1AD-4243D8127440};c
resetIEproxy;
iedefaults;
emptytemp;
C:\Windows\Installer\{9a7f898e-7e01-2f44-c634-28e8c5054e92};f
emptyclsid;
emptyiecache;
emptyjava;
emptyflash;
emptyIEcache;



• Click on Run script button
  Please wait until a logreport will open (this can be after reboot)
  
  
• Save notepad to your Desktop and attach here zoek-results.log
  
  Note: It will also create a log in the C:\ directory named "zoek-results.log"
  
  
  

**********************************


  Step#2 




> Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

> Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.

How to disable avast:

• Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
  
• In the window that opens on the top right corner, click Settings.
  
• In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
  
  
• Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
  
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn on this option after the cleaning.



> Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.


> When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
  Attach log reports ( ComboFix.txt) back to topic.



*************************


> Check USB storage devices / removable drives for malware


Download MCShield from one of the following links:

MyCity -  Official download link
Softpedija - Mirror download link

• Double click MCShield-Setup to install the application.
  
• Wait a few seconds to MCShield finish initial scan.

Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.

• Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.

When all scanning is done, you need to attach a logreport that has made MCShield.

Start -> All Programs -> MCShield -> Logs

Attach here -> AllScans.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.