Solved Sirefef trojan

[tesher07]

So windows update works but now only to an extent. When I try to update it will give me this "Windows update error 80246008" and when I tried to fix it via other forums it doesn't work. Apparently when I try to start up "BITS" in services it says it cannot find the file. So now I am stuck.

 

[Jay Pfoutz]

Go to Start / All Programs / Accessories. Right Click the 'Command Prompt' item and click the 'Run As Administrator' option.
In the Command Prompt window, Paste the following command.

REGSVR32 %SYSTEMROOT%\SYSTEM32\WUAUENG.DLL

Press ENTER.
You should see a popup that says the command succeeded.
Exit the command prompt and try Windows Update again.
Let us know the results.

 

[tesher07]

The command worked but the windows update still game me the same error.

 

[tesher07]

Ok so I found a fix online and it worked brilliantly.

http://steveit.ca/2012/07/09/windows-update-fails-missing-bits-service/comment-page-1/#comment-719

 

[Jay Pfoutz]

Any more issues?

We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

Many of the things to note for us would be:

• Slow computer
• Error messages
• Fake antivirus alerts or the icon in the system tray
• svchost.exe running at 100%
• System crashes or blue screen of death

 

[tesher07]

As of now, I do not notice any of the issues you have mentioned above. The only error message I am getting it that I have an unknown usb device connected apparently. It say Port_#0006.Hub_#0004

Windows has stopped this device because it has reported problem. (Code 43).

I am not sure if this would be relevant to a virus or not but it doesn't seem like much of an issue.

 

[Jay Pfoutz]

I would say to locate a new thread here (referral): https://www.techspot.com/community/forums/windows-bsod-freezing-restarting-help.46/

Otherwise, your computer is clean.

Clean up System Restore

Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

To manually create a new Restore Point

• Go to Control Panel and select System and Maintenance
• Select System
• On the left select Advance System Settings and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name I.e. Clean
• Select Create

Now we can purge the infected ones

• Go back to the System and Maintenance page
• Select Performance Information and Tools
• On the left select Open Disk Cleanup
• Select Files from all users and accept the warning if you get one
• In the drop down box select your main drive I.e. C
• For a few moments the system will make some calculations:
  
  
• Select the More Options tab
  
  
• In the System Restore and Shadow Backups select Clean up
  
  
• Select Delete on the pop up
• Select OK
• Select Delete

Run OTC to remove our tools

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:

• Save it to your Desktop.
• Double click OTC.exe.
• Click the CleanUp! button.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Purge old temporary files

Please download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• It will close all programs when run, so make sure you have saved all your work before you begin.
• Click the Start
  button to begin the process. Depending on how often you clean temp
  files, execution time should be anywhere from a few seconds to a minute
  or two. Let it run uninterrupted to completion.
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

Security Check

Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Tell me in your next reply, if you have completed these tasks:

• Cleaned System Restore
• Ran OTC
• Ran TFC
• Ran Security Check

Also, let me know how your computer is running, and don't forget to post the contents of the Security Check log.

 

[tesher07]

Completed all of the tasks above and the system is working great!

Results of screen317's Security Check version 0.99.43
Windows 7 Service Pack 1 x86 (UAC is disabled!)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
ESET NOD32 Antivirus 5.0
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
MVPS Hosts File
Spybot - Search & Destroy
CCleaner
JavaFX 2.1.0
Java(TM) 6 Update 30
Java(TM) 7 Update 4
Java version out of Date!
Adobe Flash Player 11.3.300.265
Adobe Reader X (10.1.3)
Mozilla Firefox (14.0.1)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````

 

[Jay Pfoutz]

Java Update!

Please download the newest version of Java from Java.com.

Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment). Please uninstall/remove each of them.

Once old versions are gone, please install the newest version.

Personal Tips on Preventing Malware

See this page for more info about malware and prevention.

Any other questions before I mark this topic solved?

 

[tesher07]

No, you may close the thread. Again thank you, I really appreciate the help!

 

[Jay Pfoutz]

Okie dokie. Glad we could help. =>SOLVED.