Solved Help removing Trojan Win64/Sirefef.Y

[johnmck]

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: McKamely
->Temp folder emptied: 380031 bytes
->Temporary Internet Files folder emptied: 97882192 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1194 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5810 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 94.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: McKamely
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: McKamely
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.48.0 log created on 06142012_210114
Files\Folders moved on Reboot...
C:\Users\McKamely\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\McKamely\AppData\Local\Temp\~DF664B42A3FA6B96A2.TMP not found!
C:\Users\McKamely\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRC0002.tmp moved successfully.
C:\Users\McKamely\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{193698CF-8920-449A-B0CA-0B2454410178}.tmp moved successfully.
C:\Users\McKamely\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{487F19FE-B0B9-42EA-96AC-D7CB1C3661D8}.tmp moved successfully.
C:\Users\McKamely\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{57FF727F-68FC-4112-9DD4-841651E8548D}.tmp moved successfully.
Registry entries deleted on Reboot...

 

[johnmck]

The computer is running perfectly. Absolutely no issues. Amazing! This thing is only 6 months old and feels brand new again. thank you for your help. great job!

 

[Broni]

Way to go!!

Good luck and stay safe

 

[johnmck]

Broni, I am wondering if there is still something infecting this PC. IE9 keeps timing out on various websites, expedia and priceline for example, during the same session in each website for no aparent reason. I just ran MSE, Secunia and Malwarebytes and it didn't find anything.

 

[johnmck]

It has been timing out like this for at least a few days before that trojan horse showed up and I started this thread.

 

[Broni]

Open IE, go Tools>Internet options>Advanced tab and click on "Reset" button.
Restart IE and see how it goes.

Your computer is definitely clean.