Solved Windows 7 laptop infected with sirefef.y Trojan

[Jay Pfoutz]

Driver software was compromised. May I know the brand or make/model of the webcam, please?

Let me know on documentation, David.

 

[David Summers]

Sorry for the delay. It's a Dell Webcam, built into the laptop. I can't seem to find anything more detailed than that when I try to do a search. There are two programs which came with the computer which access the webcam: Dell Webcam Central and Microsoft Silverlight. Neither of these recognize the camera at all.

 

[Jay Pfoutz]

Take a look here at the troubleshooter, and let me know if you can solve the problem: http://support.dell.com/support/topics/global.aspx/support/kcs/document?docid=266612

 

[David Summers]

I'm still working on getting answers from the Dell site... the problem is that when I log in, and it goes into 'examine my system' mode to determine what software I need, it seems to get locked into a neverending cycle. It's been 'examining my system' now for well over an hour, with no sense that anything is actually happening. I'm going to try to contact their tech support.

Thanks for all your help!

 

[Jay Pfoutz]

You're welcome. Try that tool in Safe Mode, and see if it will help. With being in Normal Mode, the Services running on the computer can interfere, if the tool is searching for certain drivers. This is characteristic of Windows File Protection to throw it into a continuous loop, if it's trying to get kernel-mode access.

But anyway, let's finish up here with the malware removal side of things...

Clean up System Restore

Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

To manually create a new Restore Point

• Go to Control Panel and select System and Maintenance
• Select System
• On the left select Advance System Settings and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name I.e. Clean
• Select Create

Now we can purge the infected ones

• Go back to the System and Maintenance page
• Select Performance Information and Tools
• On the left select Open Disk Cleanup
• Select Files from all users and accept the warning if you get one
• In the drop down box select your main drive I.e. C
• For a few moments the system will make some calculations:
  
  
• Select the More Options tab
  
  
• In the System Restore and Shadow Backups select Clean up
  
  
• Select Delete on the pop up
• Select OK
• Select Delete

Run OTC to remove our tools

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:

• Save it to your Desktop.
• Double click OTC.exe.
• Click the CleanUp! button.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Purge old temporary files

Download CCleaner Slim and save it to your Desktop - Alternate download link

When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
Follow the prompts to install the program.

* Double-click the CCleaner shortcut on the desktop to start the program.
* Click on the Options block on the left, then choose Cookies.
* Under Cookies to Delete, highlight any cookies you would like to retain permanently
* Click the right arrow > to move them to the Cookies to Keep window.
* Go into Options > Advanced & uncheck Only delete files in Windows Temp folders older than 48 hours
* Click Cleaner on the left then Run Cleaner on the right to run the program.
* Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

Caution: Only use the Registry feature if you are very familiar with the registry.
Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

Security Check

Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

[Jay Pfoutz]

Hello. Are you still with us?

Your thread has been marked as "Inactive" because of your lack of reply. Please let us know how your computer is running, or if you want to continue in this topic.

Thanks.

 

[Jay Pfoutz]

Topic marked solved.