BleepingComputer.com: win32 sirefef.o

Jump to content

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  • 4 Pages +
  • « First
  • 2
  • 3
  • 4
  • You cannot start a new topic
  • This topic is locked

win32 sirefef.o help, can't remove!

#46 User is offline   miri.um 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 28
  • Joined: 31-October 11

Posted 14 November 2011 - 08:49 PM

So I did what you asked but it's not working. The look.bat opens a black screen but nothing happens.

#47 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 15 November 2011 - 07:04 PM

That just isn't going to work is it? :P

How is the machine now? What symptoms do we have left?
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#48 User is offline   miri.um 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 28
  • Joined: 31-October 11

Posted 15 November 2011 - 09:46 PM

I guess not. :) Everything is running pretty well the only problem is that Firefox doesn't work anymore.
It says Unable to connect


Firefox can't establish a connection to the server at www.google.com.
The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your computer's network connection.
If your computer or network is protected by a firewall or proxy, make sure
that Firefox is permitted to access the Web.

I think it has something to do with McAfee or a firewall but I'm not sure.

#49 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 16 November 2011 - 05:01 PM

If you disable McAfee and the firewall would Firefox connect?


Please run FSS

Please download Farbar Service Scanner and run it on the computer with the issue.
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#50 User is offline   miri.um 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 28
  • Joined: 31-October 11

Posted 18 November 2011 - 04:02 PM

So my internet wasn't working for a few days but I got that working again. The problem is that IE works but not firefox and chrome. Somethings must be blocking them but I can't figure out what it is. But as long as I can access the internet I guess it's all good, even though IE sucks lol.
Heres the log:

Farbar Service Scanner
Ran by Miriam (administrator) on 18-11-2011 at 14:51:42
Windows Vista ™ Home Premium Service Pack 1 (X86)
********************************************************

Service Check:
==============

File Check:
===========
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll
[2009-04-15 19:13] - [2009-03-02 22:39] - 0551424 ____A (Microsoft Corporation) 301AE00E12408650BADDC04DBC832830

C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll
[2008-01-20 20:24] - [2008-01-20 20:24] - 0204288 ____A (Microsoft Corporation) 43A988A9C10333476CB5FB667CBD629D

C:\Windows\system32\Drivers\afd.sys
[2011-08-28 16:09] - [2011-04-21 07:16] - 0273408 ____A (Microsoft Corporation) 48EB99503533C27AC6135648E5474457

C:\Windows\system32\Drivers\tdx.sys
[2008-01-20 20:24] - [2008-01-20 20:24] - 0071680 ____A (Microsoft Corporation) D09276B1FAB033CE1D40DCBDF303D10F

C:\Windows\system32\Drivers\tcpip.sys
[2010-08-11 12:16] - [2010-06-16 09:59] - 0898952 ____A (Microsoft Corporation) 782568AB6A43160A159B6215B70BCCE9

C:\Windows\system32\dnsrslvr.dll
[2011-04-13 19:13] - [2011-03-02 08:49] - 0086528 ____A (Microsoft Corporation) 4805D9A6D281C7A7DEFD9094DEC6AF7D


Connection Status:
==================
Localhost is accessible.
LAN connected.
Google site is accessible.
Yahoo site is accessible.

#51 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 18 November 2011 - 06:39 PM

I wonder if a redirector has been only part-removed

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2
  • Ensure all Firefox windows are closed.
  • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista/Windows 7).
  • When prompted to run the scan, click Yes.
  • GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#52 User is offline   miri.um 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 28
  • Joined: 31-October 11

Posted 18 November 2011 - 08:48 PM

GooredFix by jpshortstuff (03.07.10.1)
Log created at 19:45 on 18/11/2011 (Miriam)
Firefox version 8.0 (en-US)

========== GooredScan ==========


========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [19:50 18/11/2011]
{AB2CE124-6272-4b12-94A9-7303C7397BD1} [02:22 15/09/2010]
{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} [02:57 01/02/2010]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{3112ca9c-de6d-4884-a869-9855de68056c}"="C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}" [09:05 11/02/2010]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [04:13 20/08/2009]
"smartwebprinting@hp.com"="C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2" [23:31 12/10/2009]
"{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext" [02:02 10/02/2010]

-=E.O.F=-

#53 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 20 November 2011 - 05:38 AM

Nope, that looks fine. Please reinstall both Firefox and Chrome. If the connection has been broken and the machine is clean then this will fix it. Let me know.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#54 User is offline   miri.um 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 28
  • Joined: 31-October 11

Posted 23 November 2011 - 01:45 PM

I tried reinstalling it but it didn't work for Firefox or Chrome.

#55 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 23 November 2011 - 07:01 PM

View Postmiri.um, on 23 November 2011 - 01:45 PM, said:

I tried reinstalling it but it didn't work for Firefox or Chrome.

What didn't work? The reinstall or the fix for the problem?
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#56 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 28 November 2011 - 06:36 PM

Hi,

I have not had a reply from you for 4 days. Can you please tell me if you still need help with your computer as I am unable to help other members with their problems while I have your topic still open. The time taken between posts can also change the situation with your PC making it more difficult to help you.

If you like you can PM me.

Thanks,


m0le
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#57 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 29 November 2011 - 08:41 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

Share this topic:


  • 4 Pages +
  • « First
  • 2
  • 3
  • 4
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users