virus in c:\windows\system32\services.exe Threat: Win32:Sirefef-ZT [Trj]

[dingomartin]

Hi guys,

I'm looking for some help. Seems I'm another victim to this Sirefef virus.

It's invecting my c:\windows\system32\services.exe. I can't deletet, repair, or move it, etc.

Please help!!!

Thank you.

[jeffce]

Hi and Welcome!!   

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.
• If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
• Please be sure to subscribe to the topic if you have not already done so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.

Having said that....      Let's get going!! 
----------

[jeffce]

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
  
• Double click dds to run the tool.
  
• When done, two DDS.txt's will open.
  
• Save both reports to your desktop.
  

---------------------------------------------------
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
----------

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
• Click the Scan button to start scan.
  
• If you are asked to update the Avast Virus database please allow it to do so.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

Click the image to enlarge it
----------

[dingomartin]

Hi Jeff, I really hope we can work together to fix this. However, I have disabled my avast and sownloaded both of those files to my dektop, but neither runs when I double click them.
I am told 'The system could not find the environment option that was entered.'
What now?
Thanks

[jeffce]

Hi,

What operating system are you using...XP, Vista, 7 or 8?

[dingomartin]

Windows 7 Home Premium

[jeffce]

Ok thanks....

FRST

Please download Farbar Recovery Scan Tool and save it to a flash drive.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Plug the flash drive into the infected PC.
If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.

If you are using Vista or Windows 7 enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.


Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.
To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html


To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.


On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

Select Command Prompt

Once in the Command Prompt:
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

[dingomartin]

I managed to do this. However, if I try to paste them here, they contain far too many characters. It saved two text files - FRST and Addition, both I which I attach here.

[jeffce]

Hi,

I apologize...please just attach the logs.  That is just fine. 

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

Unfortunately I have found what is known as the ZeroAccess rootkit on your system. It is an especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end we may need to reinstall the operating system anyway depending on the extent of the infection.

If you would like to format and reinstall your Operating System please let me know and we can assist you with that.

If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help. 
----------

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Note: If the tool warned you about the outdated version please download and run the updated version.

[dingomartin]

Hadto restart and command prompt again to do this. File attached. None of that stuff sounds good. I'd like to try to avoid a reformat if possible.

[jeffce]

Hi,

Good job!!  Let's keep going and try to knock this thing out. 

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Note: If the tool warned you about the outdated version please download and run the updated version.

[dingomartin]

Fix log attached. Doesn't look amssively useful to my untrained eye. I would definitely scan the crap out of that file though as it's the first one I've attached from the infected computer. C&P:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-06-2013
Ran by SYSTEM at 2013-06-20 23:26:37 Run:2
Running from C:\Users\Quentin\Desktop
Boot Mode: Recovery
==============================================

Error: DeleteJunctionsIndirectory: C:\Program Files\Windows Defender => entry should be fixed outside recovery mode.

==== End of Fixlog ====

[jeffce]

Hi,

Please re-run the previous set of instructions but just use Normal Mode for this...just like you booted normally to Windows.  Post the new log. 

[dingomartin]

I would love to... but if I try to run FRST64 once my computer has loaded normally, it doesn't load and I get the error message ''The system could not find the environment option that was entered.'' Now what?

Also, am I meant to have my anti-virus software turned off still?

[dingomartin]

I ran FRST64 in safe mode through command prompt and got this:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-06-2013
Ran by Quentin at 2013-06-21 08:16:00 Run:3
Running from C:\Users\Quentin\Desktop
Boot Mode: Safe Mode (minimal)
==============================================

C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7} => File/Directory not found.
C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7}\@ => File/Directory not found.
C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7}\L => File/Directory not found.
C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7}\U => File/Directory not found.
C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7}\L\00000004.@ => File/Directory not found.
C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7}\L\201d3dde => File/Directory not found.
C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7}\L\6715e287 => File/Directory not found.
C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7}\L\76603ac3 => File/Directory not found.
C:\Windows\Installer\{a05e8ce0-7c7b-ab76-00f9-37538e83d2f7}\U\00000008.@ => File/Directory not found.
C:\Windows\assembly\GAC_32\Desktop.ini => Moved successfully.
Could not move C:\Windows\assembly\GAC_64\Desktop.ini. => Scheduled to move on reboot.
C:\Windows\System32\services.exe 50BEA589F7D7958BDD2528A8F69D05CC ZeroAccess <==== ATTENTION!. => File/Directory not found.