also @ TechSpot: Cookie-blocking browser plugin Ghostery feeds data to the ad industry

Please help! That nasty Sirefef got me.

Discussion in 'Virus and Malware Removal' started by Phasmos, May 20, 2012.

Post New Reply
  1. Phasmos Newcomer, in training Posts: 53

    Broni, I have a bad feeling that the whole thing is starting over somehow... Cursor is sluggish again, icons starting to move around on their own again... Firefox just updated to the new version by itself and turned itself on with no prompting... and everything is very, very SLOW.

    Please tell me this thing isn't becoming reinfected...?? Could we have missed something?

    Sorry to be so much trouble... :(
  2. Phasmos Newcomer, in training Posts: 53

    Also, I have uninstalled Avast as it was chewing up too much memory. Didn't seem to be much use anyway, and it was only the 30-day trial version.

    When I check the Task Manager window, there is always something called "svchost.exe" that seems to keep forcing itself to the top of the list. Is this another evil "germ?"
  3. Phasmos Newcomer, in training Posts: 53

    It is definitely reinfected. Firefox is practically unusable, as before. Top title bar keeps blinking as if being redirected; right-click menus keep appearing in weird places, like the upper left-hand corner of the screen; cursor hangs and drags when trying to maneuver around in Google. Should I just start over? I'm way behind on a lot of work because of this damn thing...
  4. Broni Malware Annihilator Posts: 40,077   +187

    Did you follow instructions from my reply #56?
  5. Phasmos Newcomer, in training Posts: 53

    No, I was afraid to uninstall it for fear of losing my bookmarks and everything. Is it just a corrupted version of Firefox, you think?
  6. Broni Malware Annihilator Posts: 40,077   +187

     
  7. Phasmos Newcomer, in training Posts: 53

    Uninstalled Firefox and reinstalled it. Didn't work. Symptoms: Abberant behavior during Google searches. The FIrefox logo in the upper left-hand corner (in the title bar) disappears for seconds at a time and is replaced by a nondescript white box. The active tab in the system tray flashes as if another window is quickly being opened elsewhere. Cursor drags and/or freezes entirely.

    The whole system takes a very long time to respond upon startup.
  8. Broni Malware Annihilator Posts: 40,077   +187

    Is any other browser affected?

    I can see a very possible culprit:
    You have very minimal amount of RAM.
    Windows XP needs at least 512MB of RAM to run decently (1GB preferably).
    Firefox is known for eating up a lot of RAM, especially if you have number of add-ons.
    When you first open Firefox it'll already be using around 50-70MB of RAM.
    After a while that number will go up quickly.
    You definitely need more RAM.
  9. Phasmos Newcomer, in training Posts: 53

    Ah! OK, is there any way to increase the available RAM without installing more physical memory? (I don't know if this computer can take more RAM.) Deleting unused programs, perhaps?

    Also, I think I found the solution to my audio problems - my IDE driver seems to be stuck in PIO mode instead of DMA (whatever that means). Going to delete the driver and reinstall it, which may resolve the issue... (at least I hope so... got enough issues with this poor machine lately...)
  10. Phasmos Newcomer, in training Posts: 53

    YAY! Reinstalling the driver fixed the sound issue.
    Let me see what I can find out re: freeing up RAM...
  11. Broni Malware Annihilator Posts: 40,077   +187

    This can definitely cause all kind of problems including slowness.

    As for RAM you can't really get around it. You just need to get more RAM. It's cheap.
  12. Phasmos Newcomer, in training Posts: 53

    OK... Is there a simple way to determine how much RAM the machine can take vs. what is already installed?
  13. Phasmos Newcomer, in training Posts: 53

    Found the RAM answer via a little app from Crucial. Now to finish with the cleanup checklist from #60...
  14. Broni Malware Annihilator Posts: 40,077   +187

    Very well....
  15. Phasmos Newcomer, in training Posts: 53

    OK, I've run the diagnostics and nothing appears to be out of order - results of the OTL were the same as last time, so presumably the machine is free of infection. HOORAY!

    Still a bit slow and twitchy - especially with regard to a couple of processes called "svchost.exe" and "wualclt.exe" that seem to eat up a lot of RAM on startup. I know that the second one is related to Windows Update, and the first one is a sort of generic service module used by a number of programs (there are in fact 5 or 6 versions of it running now with the same name)... so I'm assuming that you're right in that the poor old thing just needs more RAM. I'll have to order some ASAP and hopefully that will speed things up.

    Thanks so much for all your help, Broni!
    Dziekuje!

    :)
  16. Phasmos Newcomer, in training Posts: 53

    BTW, do you think MSE is a good choice for general protection? Would it be likely to catch this sort of thing if it happens again? At least Avast threw up warnings telling me what it was blocking (before it got compromised, I guess)... otherwise I would never have known it was Sirefef at all. Malwarebytes, maybe?
  17. Broni Malware Annihilator Posts: 40,077   +187

    Haha...:)

    As I said you won't find any workaround regarding low amount of RAM installed.

    MSE is a very good program.
    A lot depends on your computer habits.

    Good luck and stay safe :)
  18. Phasmos Newcomer, in training Posts: 53

    Bad news, Broni...
    I just gave the machine a quick scan with MSE and it did indeed find Trojan/Sirefef. It was listed as having been quarantined. (Previous items on the quarantine list were listed as "Trojan/Sirefef.AG" and were dated from May 19th, 20th, and 21st.) I clicked "fix" and will scan again now, but the damn thing is still here - or at least was a few minutes ago.
  19. Broni Malware Annihilator Posts: 40,077   +187

    If it's quarantined there is nothing to worry about.
    You can empty those items.
    Click on the “Quarantined items” radio button to display the list of quarantined items. Then click the “Remove all” command button, or select a specific item and click the “Remove” button.