Sirefef detected but now seems gone

[Reinhard]

Panda streamed messages about Sirefef being found and disinfected but the stream of these messages was constant, every second or so, for 6 hours and still ongoing when I shut down computer last night. This morning everything seems fine - Panda and Kaspersky TDSSKiller scans show zero problems.

Could Sirefef be gone? Should I proceed with remainder of steps in your " How to remove Sirefef Trojan (Removal Guide)" ?

Computer is currently operating OK.

I checked OTL Log only because my post would not go through without it, don't know what it is.

 

[Fiery]

Hi and welcome to MalwareTips!

I'm Fiery and I would gladly assist you in removing the malware on your computer.

PLEASE NOTE: The first 3 posts of ALL new members require approval by mods/admins. Please be patient if you don't see your post immediately after submitting it.

Before we start:

• Note that the removal process is not immediate. Depending on the severity of your infection, it could take a long time.
• Malware removal can be dangerous. I cannot guarantee the safety of your system as malware can be unpredictable. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system. Therefore, I would advise you to backup all your important files before we start.
• Please be patient and stay with me until I give you the green lights and inform you that your PC is clean.
• Some tools may be flagged by your antivirus as harmful. Rest assure that ALL the tools we use are safe, the detections are false positives.
• The absence of symptoms does not mean your PC is fully disinfected.
• If you are unclear about the instructions, please stop and ask. Following the steps in the order that I post them in is vital.
• Lastly, if you have requested help on other sites, that will delay and hinder the removal process. Please only stick to one site.

<hr>
Download Farbar Recovery Scan Tool from the below link:
<ul><li>For 64 bit systems download <a title="External link" href="http://download.bleepingcomputer.com/farbar/FRST64.exe" rel="nofollow external"><>Farbar Recovery Scan Tool x64</></a> and save it to a USB/flash drive.</li>

<li>Plug the flashdrive into the infected PC.</li>

<li>Enter <>System Recovery Options</>.</li>

<>To enter System Recovery Options from the Advanced Boot Options:</>
<ul>
<li>Restart the computer.</li>
<li>As soon as the BIOS is loaded begin tapping the<> F8</> key until Advanced Boot Options appears.</li>
<li>Use the arrow keys to select the <>Repair your computer</> menu item.</li>
<li>Select <>US</> as the keyboard language settings, and then click <>Next</>.</li>
<li>Select the operating system you want to repair, and then click <>Next</>.</li>
<li>Select your user account an click <>Next</>.</li>
</ul>

<li>On the System Recovery Options menu you will get the following options:</span>
<pre>Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt</pre>
<ol>
<li>Select <>Command Prompt</></li>
<li>In the command window type in <>notepad</> and press <>Enter</>.</li>
<li>The notepad opens. Under File menu select <>Open</>.</li>
<li>Select "Computer" and find your flash drive letter and close the notepad.</li>
<li>In the command window type <><span style="color: #ff0000;">e</span>:\frst64</> and press <>Enter</>
<>Note:</><span style="color: #ff0000;"> Replace letter <>e</> with the drive letter of your flash drive.</span></li>
<li>The tool will start to run.</li>
<li>When the tool opens click <>Yes</> to disclaimer.</li>
<li>Press <>Scan</> button.</li>
<li><>FRST</> will let you know when the scan is complete and has written the <>FRST.txt</> to file, close the message.
<li>Type exit</li>
<li>Please copy and paste FRST.txt in your next reply</li></li>
</ol>
</ul>

 

[Reinhard]

Thank you for your reply. I am having a problem with the very first instruction, tapping F8 key to get to Advanced Boot Options. No matter how quickly I tap the F8 key the computer always gets to the Windows password screen with no chance to address the boot options.

It is a Samsung 9 ultrabook and starts very quickly. I have ensured that the power button is set to shut down the computer and have been using the power button to restart.

 

[Reinhard]

I turned off all Samsung fast boot options and found that holding the F8 key down (rather than tapping it) while booting would get to the Advanced Boot Options. I got to the command Prompt screen and started Notepad. When I used open to find the flash drive letter there were only 4 hard drives shown, C, D, E and X - none of these are the flash drive. I am now stymied at this point.

 

[Fiery]

Have you used the USB on this PC before? If not, it may require soem time before the pc can access the USB.

Alternatively, if you can't get the tool to run, boot to Safe mode. To access safe mode, also hold the F8 key but this time, select Safe mode with Networking. Once in safe mode, plug in the USB and run the Farbar tool in safe mode. It will produce a log on your USB once it's done.