Author Topic: Infected with Win32:Sirefef-HO [Rtk]  (Read 24274 times)

0 Members and 1 Guest are viewing this topic.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #15 on: March 07, 2012, 12:05:46 AM »
Could you go to C:\Windows\System32\drivers\etc
Right click the file called HOST and see if you can edit it in notepad

kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #16 on: March 07, 2012, 12:09:00 AM »
closest file to that name in that folder is :
hosts.ics
yes its editable


Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #17 on: March 07, 2012, 12:11:23 AM »
OK that suggests it has been hidden lets Use OTL to kill it and then re-run the MSFixit

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Quote
    :OTL
    O1 - Hosts: 109.163.226.208 www.google-analytics.com.
    O1 - Hosts: 109.163.226.208 ad-emea.doubleclick.net.
    O1 - Hosts: 109.163.226.208 www.statcounter.com.
    O1 - Hosts: 67.215.245.19 www.google-analytics.com.
    O1 - Hosts: 67.215.245.19 ad-emea.doubleclick.net.
    O1 - Hosts: 67.215.245.19 www.statcounter.com.

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #18 on: March 07, 2012, 12:15:23 AM »
OTL will not run now.
ERROR:
Cannot create file c:\windows\system32\divers\etc\Hosts.

kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #19 on: March 07, 2012, 02:38:12 AM »
shits still here. just hijacked my browser again and sent me to some site. ARGH!

kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #20 on: March 07, 2012, 07:01:01 PM »
is any other tech available to help me find a resolution to this problem?

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37527
  • Not a avast user
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #21 on: March 07, 2012, 07:05:07 PM »
Essexboy is online soon......he usually arrive around this time
depends how much work he has in the other forum

kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #22 on: March 07, 2012, 07:29:43 PM »
yay! ;D

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #23 on: March 07, 2012, 09:08:22 PM »
OK so it is playing hard to get..  Do the redirects occur in IE, Firefox or both ?


  • Run OTL.
  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
CREATERESTOREPOINT

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Post both logs
THEN

Download aswMBR.exe ( 1.8mb ) to your desktop.
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan 



On completion of the scan click save log, save it to your desktop and post in your next reply



kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #24 on: March 07, 2012, 09:39:52 PM »
thanks essexboy!
otl didnt generate in extras report
« Last Edit: March 16, 2012, 05:07:50 AM by kinji »

kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #25 on: March 07, 2012, 09:45:13 PM »
oh, and i dont use ie, so i have no idea if it's redirecting.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #26 on: March 07, 2012, 10:59:40 PM »
Avast is holding it in check - however, your  host file has been hijacked again

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Quote
    :OTL
    O1 - Hosts: 109.163.226.208 www.google-analytics.com.
    O1 - Hosts: 109.163.226.208 ad-emea.doubleclick.net.
    O1 - Hosts: 109.163.226.208 www.statcounter.com.
    O1 - Hosts: 67.215.245.19 www.google-analytics.com.
    O1 - Hosts: 67.215.245.19 ad-emea.doubleclick.net.
    O1 - Hosts: 67.215.245.19 www.statcounter.com.

    :Files
    ipconfig /flushdns /c

    :Commands
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN

Delete combofix from your desktop and download - then run a fresh copy

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks




  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.[/b]
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #27 on: March 07, 2012, 11:07:46 PM »
OTL will not run
it has an error
cannot create hostfile c:\windows\system32\drivers\etc\Hosts.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #28 on: March 07, 2012, 11:35:05 PM »
OK proceed direct to combofix please

kinji

  • Guest
Re: Infected with Win32:Sirefef-HO [Rtk]
« Reply #29 on: March 07, 2012, 11:54:39 PM »
combofix
the computer is running great
the hi-jackings are definitely lesser
« Last Edit: March 16, 2012, 05:08:07 AM by kinji »