WIN32:Sirefef-ZT Trojan found, can't remove.

[Wheezcellbert]

Hello all,

So I did a scan on my computer and found the Sirefef-ZT trojan and I can't remove it. I have ran malewarebytes and got everything off that this virus has put on but the original virus and back-door to my computer remain. I have tried several different sites online to try and get rid of this but so far have no luck on it. If someone could walk me through on how to get rid of this it would be greatly appreciated.

[Wheezcellbert]

Here are some logs, more will be coming as I read through what to do on other forums/posts. This is from OTL.

[Wheezcellbert]

This is the MBAM report.

[Wheezcellbert]

aswMBR report.

[essexboy]

Hi you appear to have a double infection here

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
[2012/10/24 10:36:50 | 000,005,120 | -HS- | M] () -- C:\Windows\assembly\GAC_32\Desktop.ini
[2012/10/24 10:36:50 | 000,006,144 | -HS- | M] () -- C:\Windows\assembly\GAC_64\Desktop.ini

:Files
C:\Windows\tasks\At*.job
C:\Windows\Installer\{317aaeae-1083-c0c8-fc3e-871ab928b933}

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[Wheezcellbert]

I think I took care of it. After running roguekiller it replaced a few files on start up and I manually installed some back-up files. After running two full scans and malwarebytes and the OTL again nothing has been detected.

[essexboy]

Could you see if windows updates works ...

Also could you post the roguekiller log

[Wheezcellbert]

This is one the other one is too large to post. And windows update says it needs to reboot first.

[essexboy]

Did you delete those with RogueKiller ?  Any further problems ?

[Wheezcellbert]

Windows updated did another scan with Avast and Malwarebytes and nothing has come up. Thanks for all the info, all I did was follow your step by step instructions from your pinned post and then the two things you posted. Thanks for the help.

[essexboy]

Cuts down the work I need to do