After restarting my computer today, I noticed Microsoft Security Essentials wasn't running (ie, it was in the system tray, but it was red with a cross through it). I wasn't able to start it up, which I found rather suspicious.
So I went to add/remove programs, removed Microsoft Security Essentials (I'll refer to it as MSE from now on), then reinstalled it (from a fresh download). This worked fine. MSE updated itself and ran an automatic quick scan, and detected several instances of Trojan: Win32/Sirefef
Specifically, it listed:
These were quarantined, and I removed them. However, I got an error message during the install of MSE saying that the Windows Firewall could not be initalized. When I tried to initalize it manually (through the control panel) I got the error: "Due to an unidentified problem, Windows cannot display Windows Firewall settings".
I restarted the computer, thinking that this might help. When I opened the history tab in MSE, it showed that it had found and quarantied the same list of four trojans again. Thinking it was time for a full scan, I started running a full MSE system scan, but that seemed to freeze my computer (admittedly, it was still starting up, so that might have been partially to blame) and wasn't progressing. I was unable to open Internet Explorer, though I got Firefox open - at this point I stopped the MSE scan, thinking perhaps that this was causing performance issues. I started looking up Sirefef in Firefox, but the computer was responding very sluggishly. I tried to bring up the task manager to no avail. So I cut my losses and hit the power button on my computer.
Before turning the computer back on, I unplugged the internet cable to ensure I was offline from now on. After the computer restarted, I tried out Internet Explorer, which was working fine now (though obviously I couldn't go online, since I was unplugged). I ran another full scan with MSE, which reported early into the scan (in an urgent alert window) that it had found Sirefef.P and needed a restart to remove it. I restarted the computer.
Again, after the restart, MSE reported finding the same four trojans. I'm currently running another full scan with MSE but it looks like this will take several hours to complete (it's at 3 1/2 hours at the moment and counting).
I've checked online on a secondary computer about this virus and while I've found various bits of advice (asking to look for various processes, registry entries, etc) I can't seem to find those on my computer. I've also run a number of removal tools including 'AntiZeroAccess', McAfee's 'Rootkitremover', ESET's 'ESETSireferRemover', but none of them found or removed anything. AntiZeroAccess did have one error while running - when it checked file 'uusbd.sys' it got an Error, but that didn't stop the program from finishing, and it still reported that my system is not infected.
MSE seems to run fine, but I'm still concerned that these same four trojans are being picked up after every restart, and I still can't activate the Windows Firewall. Any advice on how to proceed?
UPDATE: Full scan finally finished. It found Sirefef.P, which I told it to remove. After this it asked me to restart my computer. I did so, but started it up in Safe Mode, where I also ran TDSSKiller. This didn't find any infections.
Restarted again, running another full MSE scan...
Edited by Soul Reaver, 09 June 2012 - 01:03 AM.