Trojan.sirefef.fy

My computer is running very slow. I keep getting a bit defender popup that says it is blocking Trojans and asked if I want to scan and reboot to fix the problems. When scans it finds Trojans but can’t quarantine or remove some of them. It will not remove trojan.sirefef.fy

I get repeat notifications that trojan.sirefef.gz, trojan.sirefef.hk, trojan.sirefef.gy,

trojan.sirefef.gy and others is trying to access my computer. I have two computers with bit defender and they are both doing the same thing.

I see someone else with the same bug used “ComboFix”, Is it safe to use “ComboFix”? I am leery of using software I am not familiar with.

I am a newbe and not very computer literate. Any sugestions on how to fix this?

Find more posts tagged with

Comments

Hi,

Please use Bitdefender Tool http://www.hotforsecurity.com/blog/how-to-...1-2-3-1160.html

http://forum.bitdefender.com/index.php?showtopic=29525

Regards

Hi,

Please use Bitdefender Tool http://www.hotforsecurity.com/blog/how-to-...1-2-3-1160.html

http://forum.bitdefender.com/index.php?showtopic=29525

Regards

Thanks for the response and for trying to help.

However that tool didn’t work for my infected computers. I tried the “Sirefef – ZeroAccess Removal Tool”. It did not detect or remove the infected files even on either of my infected computers, even though my bit defender program was giving me alerts that my computers are infected.

Try XXXXX

Run as administrator.

Try XXXXX

Run as administrator.

Thanks i might try that, hoppeing fo offical response from Bitdefender soon.

Meanwhile I thought I would mention:

Other things I have noticed on the infected computers

1) Bitdefender will no longer update.

2) Windows defender will no longer run

Other things I have noticed on one of the infected computers.

3:) When I boot the computer I get a notice saying something like the antivirus is cleaning my system.

4) When the windows desktop open, so dose 2 note pads named desktop.ini with the following text

[.ShellClassInfo]

LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Another one that bitdefender wont remove Trojan.generic.7552386

Hello

Please tell me what version of Bitdefender are you using? I need this so I ca post here further instructions.

Have a great weekend!

Hello

Please tell me what version of Bitdefender are you using? I need this so I ca post here further instructions.

Have a great weekend!

I have bit defender antivirus plus 2012 on one infected computer and 2011 on the other infected computer. Neither version of bit defender is removing or quarantining the infections. Sometimes it says it’s removing some of the infections, just to have the all of the infections reappear after rebooting.

Try scaned computer using Rescue Mode

It will not delete Rootkit, but delete other viruses.

Christian, sorry for a wrong link, but if Bitdefender Tool not working?...

[Ticket ID:201207211002208]

I have been waiting over 48 hours for Bitdefender support to come up with a solution. They said they would have a solution in 24-48 hour, but then I got an automated after 24 hour saying that I should hear from then in 48 hours. Well they are already late; it’s over 48 hours after my first contact. Though it could be interrupted as the automated response was adding another 24 hours to their estimate (that would be a dirty trick).

Both of my computers are infected even though they are not sharing files. I sent bitdefender scan logs on both of my computers. I sent the first scan log over 48 hours ago, yet still no solution.

I also tried BDRemovalToolLauncher_sirefef and it did not find or clean anything on either of my computers.

Hello

In order to be able to assist you please run a Full System Scan task with Bitdefender and send us the resulting scan report.

[how to GENERATE A FULL SYSTEM SCAN LOG in Bitdefender 2012]

- Before running the scan please make sure that you have the latest virus definitions downloaded via the Update module.

For this you need to open Bitdefender and from the main interface click on Update now;

- After the update process has completed successfully you can proceed to running the scan task. In the same window go to Antivirus and press the Scan now button =>Full system scan.

- After the scan has finished you need to submit the scan log file. This is accomplished by running the Support tool file that can be

downloaded from this location:

http://www.bitdefender.com/files/Knowledge...or_scanlogs.exe

Save the file prior to running it and to continue you need to accept the terms of use.

At the end of this process an archive will be created on your Desktop starting with bdamst.

If the file is too big to attach it, upload it on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

NOTE! If you already ran a scan task you can send us your latest report instead.

[how to RETRIEVE THE LATEST FULL SYSTEM SCAN LOG]

-To retrieve an existing scan log you simply need to run the Support

tool file from this location:

http://www.bitdefender.com/files/Knowledge...or_scanlogs.exe

Save the file prior to running it and to continue you need to accept the terms of use.

At the end of this process an archive will be created on your Desktop starting with bdamst.

If the file is too big to attach it, upload it on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

If you were already asked to generate the log file, disregard the message above and just post the ticket ID.

We are looking forward to hearing from you!

Take care.

Hello

In order to be able to assist you please run a Full System Scan task with Bitdefender and send us the resulting scan report.

[how to GENERATE A FULL SYSTEM SCAN LOG in Bitdefender 2012]

- Before running the scan please make sure that you have the latest virus definitions downloaded via the Update module.

For this you need to open Bitdefender and from the main interface click on Update now;

- After the update process has completed successfully you can proceed to running the scan task. In the same window go to Antivirus and press the Scan now button =>Full system scan.

- After the scan has finished you need to submit the scan log file. This is accomplished by running the Support tool file that can be

downloaded from this location:

http://www.bitdefender.com/files/Knowledge...or_scanlogs.exe

Save the file prior to running it and to continue you need to accept the terms of use.

At the end of this process an archive will be created on your Desktop starting with bdamst.

If the file is too big to attach it, upload it on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

NOTE! If you already ran a scan task you can send us your latest report instead.

[how to RETRIEVE THE LATEST FULL SYSTEM SCAN LOG]

-To retrieve an existing scan log you simply need to run the Support

tool file from this location:

http://www.bitdefender.com/files/Knowledge...or_scanlogs.exe

Save the file prior to running it and to continue you need to accept the terms of use.

At the end of this process an archive will be created on your Desktop starting with bdamst.

If the file is too big to attach it, upload it on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

If you were already asked to generate the log file, disregard the message above and just post the ticket ID.

We are looking forward to hearing from you!

Take care.

[Ticket ID:201207211002208]

I have been waiting over 48 hours for Bitdefender support to come up with a solution. They said they would have a solution in 24-48 hour, but then I got an automated after 24 hour saying that I should hear from then in 48 hours. Well they are already late; it’s over 48 hours after my first contact. Though it could be interrupted as the automated response was adding another 24 hours to their estimate (that would be a dirty trick).

Both of my computers are infected even though they are not sharing files. I sent bitdefender scan logs on both of my computers. I sent the first scan log over 48 hours ago, yet still no solution.

I also tried BDRemovalToolLauncher_sirefef and it did not find or clean anything on either of my computers.

It used to take a few minutes to do a full system scan, now that my computers are infected, it takes several hours. I am not sure I did a full scan before the reports, but I have sent several reports. I am doing a full scan on my net book with a very small hard drive; it’s been scanning for about 2.5 hours and is less then halfway done. I will send anther report when I’m done.

If possible I would rather not run my desktop until a solution is found. I have a lot of important work on my desktop. I want to keep the risk as low as possible that the work will be lost

It seems the longer I run the computer infected and the more I reboot it: the slower and more corrupt, slower and glitchy it gets.

IE and foxfire browsers are getter redirected/hijacked more often. Not sure I will be able to get or send email much longer.

The bug seems to often prevent me from getting updates.

Before the infection, a bit defender full scan only took a few minutes, on this netbook . It’s been over 8 hours I have been running a full bit defender scan and it still has not completed. It looks like it will be hours, possibly days for the scan to complete; if the scan ever completes

[Ticket ID:201207201004272]

I submitted a new scan log after an update and full scan. However I’m not sure it scanned all the files, it did not delete all the malicious software because the bit defender scan summery says that 10 files were skipped because the user dose not have administrator rights. I am the only user, therefore I am the administrator.

I did/allowed a second scan that seemed to allow bit defender to have administrative rights.

It said it removed a lot of threats, but at least one failed. Most if not all of the threats will likely respawn themselves.

A full scan normally takes just a few minutes on this computer that has a small hard drive and not much loaded on it. That last scan took about 10 hours to complete.

I also previously submitted scan logs for my desktop that seems to have the same infection.

It's been over 2.5 days since I contacted support and reported this mass infection, still waiting for a solution.

When I first contacted bitdefender support, they said I should get a solution in 24-48 hours. Over 72 hours has past and they still haven’t contacted me with a solution.

I now have two different ticket numbers

201207211002208

201207221005458

Hello

I am here to assist you in this issue. Let's now collect the logs from the second scan.

http://www.bitdefender.com/files/Knowledge...or_scanlogs.exe

Save the file prior to running it and to continue you need to accept the terms of use.

At the end of this process an archive will be created on your Desktop starting with bdamst.

Upload that file on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

Have a nice day!

Hello

I am here to assist you in this issue. Let's now collect the logs from the second scan.

http://www.bitdefender.com/files/Knowledge...or_scanlogs.exe

Save the file prior to running it and to continue you need to accept the terms of use.

At the end of this process an archive will be created on your Desktop starting with bdamst.

Upload that file on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

Have a nice day!

I started sending bit defender reports and scan logs to Bitdefender suport over 3 days ago, and still have not been contacted with a solution to fix the problems.

I just PMed you links to the most recent scan logs of both computers, after BD was updated, then did a full scan both of my computes, then made scan logs of both computers.

Hello

I can see that on both computer the same files are flagged as infected.

Since the altered file is a critical file from Windows, you will have to run System File Checker to repair and replace this file. You have here all the details about the process:

http://www.sevenforums.com/tutorials/1538-...le-checker.html

Make sure that you have the Windows CD around because you might need it.

After this, reboot and let me know you Bitdefender still finds that malware.

Take care.

Hello

I can see that on both computer the same files are flagged as infected.

Since the altered file is a critical file from Windows, you will have to run System File Checker to repair and replace this file. You have here all the details about the process:

http://www.sevenforums.com/tutorials/1538-...le-checker.html

Make sure that you have the Windows CD around because you might need it.

After this, reboot and let me know you Bitdefender still finds that malware.

Take care.

It’s been over 4 1/2 days since I sent scan logs to support, and still have not received a solution from support.

Bit defender Antivirus plus 2012 on my net book

Bitdefender antivirus pro 2011 on my desktop

I don’t have any windows CD. It seems most companies don’t include CDs anymore. Instead they have an option to burn one set of CDs to reinstall. I made them for my desktop but not sure where they are or what condition. I never made them for my netbook because my netbook has no burner.

If I got a burner and tried to burn the CDs I question if they would be any good, I fear the infection might be passed on to CDs and or CDs might not be any good since the infected computer is so glitchy.

Hello

I can see that on both computer the same files are flagged as infected.

Since the altered file is a critical file from Windows, you will have to run System File Checker to repair and replace this file. You have here all the details about the process:

http://www.sevenforums.com/tutorials/1538-...le-checker.html

Make sure that you have the Windows CD around because you might need it.

After this, reboot and let me know you Bitdefender still finds that malware.

Take care.

I haven't yet disabled real-time antivirus or used Repair Windows 7 System Files with System File Checker. I'm leery to do such, and want to do it only if I have to, when I have a clear head and time to study the procedures.

Finally got a response from support.

We managed to create a removal tool for the sirefef infection on both x64 and

also x86 systems, I uploaded the files below.

64 bit version http://www.sendspace.com/file/mrzb6i

32 bit version http://www.sendspace.com/file/yl00jf

I tried the new removal tool. The tool found and removed Trojan.sirefef, I rebooted to finish the cleaning process. As a precaution I updated the bit defender antivirus and did an antivirus scan. The antivirus found Trojan.sirefef Trojans as well as other Trojans and removed them. However they seem to continue to re-spawn so there must be elements of the Trojans hidden somewhere else.

I will be sending a new scan log. Though both of my computers still seem to be infected, their performance is not as bad as before I used the latest scan tool. So it does seem to be a step in the right direction.

Bit defender Antivirus plus 2012 on my net book

Bitdefender antivirus pro 2011 on my desktop

Both are Windows 7 Home prem 64 bit

Hello

I have received the files but I will also need a BDSYS log from both PCs.

[how to GENERATE A BDSYS LOG]

. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

. Make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall

alert,select to Allow the application to connect;

. Click the "Create log" button to start generating the

log; A progress bar is indicating that the tool is creating the report;

. When the small window appears with the message "Log

saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

. Upload that file on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

If you were already asked to generate the log file, disregard the message above and just post the ticket ID.

IMPORTANT:

.During this process the Real Time Protection in Bitdefender must be temporarily disabled;

.If you receive a Bitdefender Firewall alert to inform you that BDSysLog_i.exe tries to connect to the internet,then you need to select Allow;

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2012]

In order to disable the antivirus protection, please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield" tab and click on "ON" under On-access scanning. Select the time interval that suites your troubleshooting needs and click "OK". The On-access scanning should be enabled back after finishing the troubleshooting procedure.

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2013]

In order to disable the antivirus protection, please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield" tab and click on "ON" under On-access scanning. Select the time interval that suites your troubleshooting needs and click "OK". The On-access scanning should be enabled back after finishing the troubleshooting procedure.

We will get back to you as soon as the analysis is complete.

Have a nice day.

To whom it may concern. I still don't think my problem is solved, but with the help of support and with some of my own investigation, I think I may have made another step in the right direction.

I'm no computer expert. I even have a hard time understanding directions from support and Samaritans.

However even with my very limited knowledge I may have found one of the components that has been causing/allowing the Trojans to re-spawn.

On boot on my netbook I was getting a couple duplicate ****** text files that were opening with code. On both my netbook and my desktop after running the bidefender Trojan tool (ZeroAccess (Rootkit.Sirefef) BDRemovalToolLauncher_sirefef) and bidefender defender antivirus; and after they found and allegedly removed the Trojans, the Trojans would still re-spawn after reboot, and on my netbook the ****** files still opened. I looked at the name of the text file that was open, and saw that there was a companion file on my desk top and in the start menu on both my netbook and desktop comuters. I was irritated by the ****** that was opening, so I deleted the file from my desktop and the startup menu on both computers. Since then the scripts have not been running on boot, the scans have been quicker, and so far the scans have not found any more Trojans. My browsers seem to be running quicker, and so far haven't been hijacked (redirected) to **** and shady sites trying to sell products/services or get personal information. It seems that the file that I deleted may have been key components for the Trojans to respawn.

In my case the file was named 'desktop.ini' it was a configurations settings & type of file

I still think there probably is remnants of Trojan.sirefef & generic Trojan variants on my computer.

I am still following your progress, thanks for the posts. Same, I am seeing the desktop.ini file being created.

The Trojans on my desktop computer are starting to re-spawn.

1: Christian. If I recall correctly, you told me to turn off the antivirus auto protect. I'm leery to do this, so I only want to do it as minimal as possible. Please tell me specifically for what procedures the auto protect needs to be off. Does it only need to be off during generating a BDSysLog? Or does it need to be off at other times?

2: Submitting quarantined items. It’s easy to submit suspicious items Bitdefender antivirus pro 2011 on my desktop. However with Bit defender Antivirus plus 2012 on my net book, I see an automatic submit feature, however none of the quarantined items have been submitted. Is there some way on that version of antivirus, manually prompt submit quarantine items?

3: Removing the file desktop.ini seemed to temporarily stop and slow the Trojans respawning. It seems that they are adapting, because they are now starting to respawn, and seem to be gaining ground and accelerating. Though not as bad as it was a few days ago.

I’m not sure if the origin of the Trojan respawns is from within the computer or if it’s getting back in via the Internet.

The problem with message board and e-mails support, is that I have to reconnect my computer the Internet to try to get help

Hello

Regarding that desktop.ini, are you referring to the one that is displayed on startup?

There is a fix for that here:

http://support.microsoft.com/kb/330132

Or is it the one detected by Bitdefender?

Thank you!

Hello

Regarding that desktop.ini, are you referring to the one that is displayed on startup?

There is a fix for that here:

http://support.microsoft.com/kb/330132

Or is it the one detected by Bitdefender?

Thank you!

You didn’t answer my questions.

My netbook computer still seems to be clean so far, though on my desktop Trojan.sirefef.fy keeps respawning after being deleted or moved to quarantine.

Desktop.ini seems to be or be infected with Trojan.generic.7552386

At first I don’t know if “Desktop.ini” was flagged by Bitdefender or not. I was tired by having to click through the text ******, then I figured out it was from a file that was on the desktop and in the startup menu. It was an irritation, so I moved it to the recycle bin. After I removed it to the recycle bin, the Trojans didn’t respawn for a few boot and scan cycles. However of eventually the Trojans have started to reoccur, though so far they don’t seem to be as bad yet. It seems that eventually that bit defender recognized that “Desktop.ini” is or contained the Trojan.generic.7552386

It's been a week since I first contacted Bit defender support. The problems still have not been resolved.

Hello

Please check my answer from here:

http://forum.bitdefender.com/index.php?sho...st&p=150971

Thank you very much. Have a great weekend!

I called bit defender support with similar results.

BitDefender chatlog. My personal info edited for my privacy. typos not edited:

You are now speaking with Aaron of Technical Support.

Aaron: Welcome to BitDefender LiveAssistance!, Greenhorn! Thank you for your interest in our security solution BitDefender.

Greenhorn: At the bitdefender message board, Christian claims that there is a new trojan.sirefef scan tool. However he posted a link to the old scan tool that many of us have already tried, that didn’t work right.

Could you please provide the link to the new trojan.sirefef scan tool. I have been contacting bit defender support for over a week, and still have not received a proper solution.

Aaron: Hello Greenhorn!

Greenhorn: hello

Aaron: Can you please give me the link you are referring too, Greenhorn?

Greenhorn: http://www.hotforsecurity.com/download/sir...val-tool-64-bit

Greenhorn: thats the old link july 9th

Greenhorn: thats the link he posted today as new today

Aaron: And the link to the original post please?

Greenhorn: http://forum.bitdefender.com/index.php?sho...mp;#entry150971

Aaron: Thank you.

Aaron: One moment please.

Aaron: Thank you for waiting Greenhorn.

Aaron: This situation needs to be escalated to the malware department.

Aaron: I cannot state exactly what is going on because the malware department did not inform us of anything yet.

Aaron: Therefor I will escalate your situation and you will receive more information in 24-48 hours on your e-mail address.

Greenhorn: For the most part they have not been responding, I have sent them logs and asked them qestions for over a week

Greenhorn: thats what I was told a week ago

Aaron: The situation is under investigation.

Aaron: They will reply to you as soon as possible with the information required.

Greenhorn: I have been whating over a week with infected computers

Greenhorn: waiting

Greenhorn: other have been waiting too

Greenhorn: others

Greenhorn: A lot of people have thease bugs and have been waiting many days for a solution

Aaron: There is not much I can do right now since we also did not receive any instructions from the malware department,.

Greenhorn: I guess this chat is futile then

Aaron: I will escalate your issue and you should wait for the malware department to respond.

Greenhorn: ok

You didn’t answer my questions.

My netbook computer still seems to be clean so far, though on my desktop Trojan.sirefef.fy keeps respawning after being deleted or moved to quarantine.

Desktop.ini seems to be or be infected with Trojan.generic.7552386

At first I don’t know if “Desktop.ini” was flagged by Bitdefender or not. I was tired by having to click through the text ******, then I figured out it was from a file that was on the desktop and in the startup menu. It was an irritation, so I moved it to the recycle bin. After I removed it to the recycle bin, the Trojans didn’t respawn for a few boot and scan cycles. However of eventually the Trojans have started to reoccur, though so far they don’t seem to be as bad yet. It seems that eventually that bit defender recognized that “Desktop.ini” is or contained the Trojan.generic.7552386

It's been a week since I first contacted Bit defender support. The problems still have not been resolved.

Hello

Regarding that desktop.ini, are you referring to the one that is displayed on startup?

There is a fix for that here:

http://support.microsoft.com/kb/330132

Or is it the one detected by Bitdefender?

Thank you!

It seems on both of my infected computers that "Desktop.ini" often is or is infected with 'Trojan.sirefef' and or 'Trojan.generic' variants

Hello

With all the respect Sir, you don't have to spam all the area with the same post.

As I mentioned over here http://forum.bitdefender.com/index.php?sho...st&p=150971 those removal tools are new and the links are the same because the file has the name of the old one. We choose this format because in this way we can update the removal tool without actually change the download link.

Please download that removal tool and follow the steps from that topic.

On the other PC with Bitdefender 2011, make sure that you have the latest definitions before scanning the PC one more time.

Thank you very much.

Hello

With all the respect Sir, you don't have to spam all the area with the same post.

As I mentioned over here http://forum.bitdefender.com/index.php?sho...st&p=150971 those removal tools are new and the links are the same because the file has the name of the old one. We choose this format because in this way we can update the removal tool without actually change the download link.

Please download that removal tool and follow the steps from that topic.

On the other PC with Bitdefender 2011, make sure that you have the latest definitions before scanning the PC one more time.

Thank you very much.

It's not respectful to portray me as a spammer. If I am spammer, then you are a spammer.

You don't seem to be listening (taking heed) of what we are telling you. I think that is disrespectful.

You still haven’t answered the questions I asked several days ago, even after I reiterated.

If I'm wrong I'm sorry. However I still think you are mistaken. The date on the site that you have linked, indicates July 9. Yet it seems the link contains a newer file, but it doesn't seem as new as you claim.

Unfortunately it seems that Bitdefender staff doesn't keep up with a lots of things. Like revising the dates on websites. Like revising build numbers.

I have at least two different versions of BDRemovalToolLauncher_sirefef_x64.exe yet they have the same file/product version. 2.2.0.5 Is not the proper protocol to advance the file/product version every time there is a new build?

‎The BDRemovalToolLauncher_sirefef_x64 I uploaded 7-20-2012 has a digital signature of Monday, ‎July ‎02, ‎2012 11:57:50 AM and is 11,947kb file/product version. 2.2.0.5

‎The BDRemovalToolLauncher_sirefef_x64 I uploaded 7-24-2012 has a digital signature of ‎Tuesday, ‎July ‎24, ‎2012 12:43:35 PM and is 13,533kb file/product version. 2.2.0.5

‎‎The BDRemovalToolLauncher_sirefef_x64 I uploaded today 7-28-2012 from the link you just posted has a digital signature of Tuesday, ‎July ‎24, ‎2012 12:43:35 PM and is 13,533kb file/product version. 2.2.0.5

I ran the BDRemovalToolLauncher_sirefef_x64 and it is still not detecting or removing some of the variants of Trojan.sirefef that is on my desktop computer.

It seems the tool you posted as new yesterday, was a tool from several days ago that many of us have already told you was not removing some variants of Trojan.sirefef.

It seems the tool that you posted yesterday as new, is the same tool from 7-24-2012 that many of us have told you was ineffective against some variants of Trojan.sirefef.

Today I downloaded another copy of BDRemovalToolLauncher_sirefef_x64 from the link you just posted. I ran it and it found no infections. I immediately ran a bitdefender full scan, and it found and quarantined Trojan.sirefef.fy. So it seems that the alleged "new" tool is still not finding some variants of the Trojan.sirefef. It seems that the alleged "new" tool is an older tool from the 7-24-2012 that many of us already told you was not working on our infections. Even though bit defender antivirus found and allegedly quarantined the Trojan, the Trojans keep coming back on subsequent boot and scan cycles.

I agree with greenhorn - this is ridiculous. I don't hear anything from bitdefender for a week or more after every request - I to am getting the July 24th version of your removal tool. And the 64bit version doesn't even run on by 64bit OS. So no, it is not removing squat.

Hello

Sorry for the delayed reply.

First of all, that counter from hotforsecurity.com has to be updated by hand. The person that uploaded those removal tools there forgot to update that information too.

Now, regarding the digital signature, you are absolutely right, the removal tools were compiled on the 24th of July and after that there were sent to the testing team.

We can not offer unstable tools to our customers.

Now, please delete all the tools that I have sent you these days, download please that version and run a scan.

http://forum.bitdefender.com/index.php?showtopic=29525

After that, please update Bitdefender from the main interface and run a system scan.

Send me please the logs: http://forum.bitdefender.com/index.php?sho...st&p=150149 and a new BDSYS: http://forum.bitdefender.com/index.php?sho...st&p=150639

I also attached some steps that you need to follow when the scanning process finished. They are from Bitdefender 2012, but the same situation is on Bitdefender 2013 too.

Thank you for your patience and for the cooperation with BitDefender team.

Have a great week!

And once again, the tool does not work - not surprising since this is the exact same tool I already tried and reported didn't work. So I got the exact same result: no viruses detected/cleaned. New logfiles at http://www.mediafire.com/download.php?y6pjiv62q6w2bwt

Hello

Sorry for the delayed reply.

First of all, that counter from hotforsecurity.com has to be updated by hand. The person that uploaded those removal tools there forgot to update that information too.

Now, regarding the digital signature, you are absolutely right, the removal tools were compiled on the 24th of July and after that there were sent to the testing team.

We can not offer unstable tools to our customers.

Now, please delete all the tools that I have sent you these days, download please that version and run a scan.

http://forum.bitdefender.com/index.php?showtopic=29525

After that, please update Bitdefender from the main interface and run a system scan.

Send me please the logs: http://forum.bitdefender.com/index.php?sho...st&p=150149 and a new BDSYS: http://forum.bitdefender.com/index.php?sho...st&p=150639

I also attached some steps that you need to follow when the scanning process finished. They are from Bitdefender 2012, but the same situation is on Bitdefender 2013 too.

Thank you for your patience and for the cooperation with BitDefender team.

Have a great week!

Hello

Could you please send me also a scan log?

http://forum.bitdefender.com/index.php?sho...st&p=150149

Thank you!

I contacted bit defender support, nearly 2 weeks ago, still with no solution. For nearly 2 weeks I've been trying to get bit defender support to find a solution to remove Trojan.sirefef.fy. So I fear for the well-being of my computer, and of my personal information.

My bitdefender is about to expire, at this rate I doubt I will renew. I'm not going to renew a product that is not doing its job and doesn't have decent support. I also doubt I'm going to renew, because I feel that I have been slandered by a bitdefender employee.

I've been trying to get help and to help others; yet I've had many of my post removed and have been slandered by being falsely accused of being a spammer. I get the impression that bitdefender is losing a lot of customers, because of lousy support.

I've asked supports many questions, repeatedly; yet for many of those questions have gone unanswered for quite some time, even though I have reiterated some of the questions. I even started another thread because some of the other issues involve other Trojans and my questions were never answered and there is no apparent effort to try to solve the problem; just to have Christian, the moderator to close the thread. Several days later, the problem still have not been addressed.

It seems that many of the users including myself that already have ran (or tried to run) the removal tool with the digital signature of Tuesday, July 24, 2012 12:43:35 only to find that it didn't find or remove the Trojans or didn't find or remove all of the variants of Trojan.sirefef or it would not run at all. IIRC some users claim they have Windows 7 64-bit, and can't get the tool to run at all. The tool runs on my computers, but it does not find or remove all of the variants of Trojan.sirefef. It seems you have told many users that already have used the Trojan.sirefef removal tool with the digital signature of Tuesday, July 24, 2012 12:43:35; to download a "new" removal tool. But the "new" tool seems to be the same old one that people already ran. It seems you're not paying attention (taking heed of what people tell you) and as a result you are wasting people's time and losing customers.

I started having problems with all these Trojans, just after bit defender started hijacking my browser to try to get me to renew my subscription. I can't help but wonder if the bit defender browser hijacker (spam redirector), may have opened a security door that let in all these Trojans that is causing all the problems I am having.

Why should I renew a product that hijacks my browser and spams me much like some Trojans do? Why should I renew a product that has significant faults and doesn't have good support and doesn't have good resolutions?

There is a saying, that one of the definitions of insanity. Is doing the same thing over and over and expecting different results. It seems as if you are trying to get us to run the same old tool over again and pass it off as new, but expect different results.

I have used the new tool, the new tool runs on my Windows 7 64-bit computer, but it does not find or remove Trojan.sirefef.fy. Bit defender antivirus is now finding the Trojan, it can't clean it, but I've been putting it in quarantine. But it respawns (comes back, or is not properly/fully removed).

If anybody was spamming, it was you (Christian). I was merely pointing out that you appeared to be calling an old tool that many of us have already used as "new". It seems that you were wasting people's time and causing frustrations. It seems that you were ignoring that there was and still is a problem with the tool. So if anything I was just merely trying to correct your misleading "spam"s.

But at least Christian has responded and offered some help. E-mail support and chat support has been a useless waste of time.

Now, regarding the digital signature, you are absolutely right, the removal tools were compiled on the 24th of July and after that there were sent to the testing team.

Then you need to stop calling it new, to people that already used them several days ago and have told you that it is flawed several days ago.

We can not offer unstable tools to our customers.

Agreed. That needs to be corrected. As many of us have pointed out, for some people the tool won’t even run, for some others it does not detect and remove Trojan.sirefef.

I also attached some steps that you need to follow when the scanning process finished. They are from Bitdefender 2012, but the same situation is on Bitdefender 2013 too.

What about, Pro 2011? Once again you don’t seem to be paying attention. I already posted that I’m running Pro 2011.

After that, please update Bitdefender from the main interface and run a system scan.

Send me please the logs:

I’ve already done that many times. I’m still waiting for a response from the logs I sent in several days ago. Several days ago I submitted logs to you by PM and I also e-mailed them to support and am still waiting for a solution. You're like a broken record, you keep on wanting us to run the same old flawed tool and procedure over and over but you seem to expect different results and you don't get back with us with a solution.

You still did not answer the questions about these procedures I asked several days ago.

Hello everyone

@ myranalis2

Are you sure that you have the latest definitions in the product? The BDSYS log collected a sample that is already detected and we think your product is not up-to-date.

@ Greenhorn

Since my last post on this topic, I haven't received the requested logs.

Each case with this infection(Sirefef is a rootkit) is unique.

Also, since you are using Bitdefender 2011 on that machine, please upgrade to Bitdefender 2013 by following these steps.

http://forum.bitdefender.com/index.php?act...f=196&id=42

The engine and technology integrated in Bitdefender 2013 is newer and it should clean the infection.

After this, update Bitdefender from the main interface and follow the steps from here:

http://forum.bitdefender.com/index.php?sho...st&p=151380

Your cooperation on this matter is greatly appreciated.

Have a great weekend!

It’s been 16 days now, and still no solution.

@ Greenhorn

Since my last post on this topic, I haven't received the requested logs.

Each case with this infection(Sirefef is a rootkit) is unique.

I still have not received a response from you or bit defender customer email support, about the logs I sent you and bit defender customer support on 7-26-2012.

Also, since you are using Bitdefender 2011 on that machine, please upgrade to Bitdefender 2013 by following these steps.

I was afraid that if I “upgraded” that it might not detect Trojan.sirefef.fy. I upgraded and sure enough it has not detected or removed Trojan.sirefef.fy.

As I already posted I was having problems with the 2012 version, because I couldn’t figure out how to get the bit defender to submit items that were in quarantine for evaluation.

The 2012 version of bit defender started occasionally crashing during scanning after the Sirefef infection. Also the settings of bit defender kept on lowering. I prefer to have the settings for aggressive detection, however it kept on changing to a custom setting that seem to have a less aggressive detection and seem to skip more files.

So I’ve went ahead and upgraded both the netbook and the desktop computers to bit defender 2013.

On my desktop computer. I’m puzzled by some of the scan results, because it says 92 items can’t be scanned due to password protection. Yet I am unaware of anything that is password protected. IIRC when I went to investigate the items that were password protected seem to be bit defender files.

It said that many files failed to be cleaned and it recommended that I reboot in a rescue mode. I rebooted in the rescue mode, and did a scan and it did not detect any infections or clean any files.

I suspect my desktop and possibly my notebook is still infected with Sirefef, because after upgrading it has not detected Sirefef. Before upgrading my desktop was chronically detecting Sirefef, because it would respawn after it was detected and quarantined.

@ myranalis2

Are you sure that you have the latest definitions in the product? The BDSYS log collected a sample that is already detected and we think your product is not up-to-date.

Due to the inadequate support received from bitdefender to date I have removed the product and will no longer be using it. For your reference though, those log files were collected with the 2011 versions of the software that with fully up to date virus definition.

It's been about 18 days since I first contacted bitdefender support about the Trojan.sirefef and other Trojans that have infected my computer, yet the problems still aren't resolved and there doesn't seem to be an honest effort to resolve them. (I think I first contacted bit defender suport about this infection on july 19th)

As Christian seemed to be encouraging me, I upgraded both of my computers to Bitdefender 2013. I'm suspicious that my netbook computer may have still had some infections, because it still seem to be having some symptoms, though most major components of the Trojans seem to be removed. Bitdefender 2011 was still indicating that my computer was still infected with one or more variants of Trojan.sirefef. Bitdefender 2011 would detect and allegedly quarantine the Trojans, but they would often respawn after rebooting and subsequent scans would find an quarantine Trojan.sirefef and sometimes other Trojans. After I upgraded my desktop it has not detected or removed or quarantined any Trojans; so I suspect it is not detecting those Trojans. Though the scans to detected hundreds of files that failed to be cleaned. I rebooted in the rescue mode, and Bitdefender didn't find or clean any infections.

Miraculously and suspiciously on the latest scans; Bitdefender has not detected anything except for cookies. Miraculously and suspiciously the hundreds of red flagged files that Bitdefender said were "failed to be cleaned", and were not deleted or quarantined are no longer being detected. Which makes me suspect that I am still infected, with infections that Bitdefender is no longer detecting.

On my netbook that I also just recently upgraded to Bitdefender 2013, Bitdefender still sometimes crashes even after the upgrade. The crashes started after the infection, so I suspect that computer is still infected and or there is still damage from the infection. Windows defender and Windows firewall still does not work on that computer, and I suspect that some window files will have to be repaired or replaced before they start working correctly. I suspect that the Trojans disabled many security features, so now I fear that my computers are much more vulnerable than they normally would be.

I got my Windows firewall and Windows defender working on my desktop, by using system restore. Windows defender found and removed one bug that Bitdefender did not detect. Regretfully I can't restore my netbook, because it seems that I may have turned off the restore feature, or that the bug may have removed the restore points on my netbook.

I'm afraid that repairing the window files and finding and repairing compromised security features is well beyond my technical capability. That's a big reason why I purchased security software like Bitdefender, hoping that it would protect me, or be able to repair damages from infections. So far I feel that Bitdefender has dropped the ball.

1) Bitdefender did not prevent the infections from entering my computer.

2) Bitdefender did not have inoculations to prevent the infection from taking hold in my computer.

3) After my computer was infected, Bitdefender and Bitdefender tools were often ineffective at detecting and removing many of the infections and repairing the damage.

4) Bitdefender support also seems to have been inadequate at addressing the issues. Bitdefender e-mail support, chat support, phone support, and forum support have all seemed inadequate in addressing the infections from Trojan.sirefef and the other Trojan(s) that seem to accompany the infections at the many of us have. There has been times I feel that Bitdefender staff has been less than genuine. Token efforts and on one occasion abusive.

I have had the same problem with my laptop and have been keenly watching the progression of this thread. I too am infected and have searched high and low to find an answer that does not require me to go above and beyond what I expect from an anti virus program to do that I paid for. I am not interested in manual removal, in fact if that was my only option my laptop would be a 2 pound boat anchor.

It is obvious, and no I will not do logs etc for someone to scrutinize and tell me it was all for naught as we are without a clue.

I appreciate Christian as he is more likely a front line soldier taking grenades for a company that has no answers.

I too will be removing my operating system and with it two years of files. And no I will not recommend this product.

To Christian. Good work my son, find your own path. You can do better...right?

Bit defender did not detect Trojan.sirefef on either of my computers but I suspected they were infected with a variant of Trojan.sirefef. I tried an online scanner from a competitor and it seems to have found and removed the Trojan.sirefef variant.

It also found a suspicious file, that seems to be an exploit to insert malicious software that is probably how Trojan.sirefef, and other Trojans and malicious files kept on entering and respawning in my computer; after being deleted.

The names using a competitor jargon/names.

MAL_XIN12 = suspicious files that have some of the characteristics of Trojan.sirefef family.

JAVA_DLOAD.ZW seems to use and exploit in Java to insert malicious files.

Before I scanned my computer with the competitor software, I noticed what seems to be a disturbing trend on the bit defender scans. It appears that an alarming and suspicious and increasing amount of files are being skipped. I fear that malicious software may be tricking the security software to ignore/skip files that might be infected. That’s also why I’m concerned that there are so many password-protected files, when I don’t normally make files password protected.

548854 scanned items

532860 skipped items

I’m hoping that the infection is gone, but I won’t be convinced four a while. Then will come the task of trying to repair my Windows on my netbook, so my Windows firewall will start working, my Windows update will start working, and my window defender will start working.

It seems to be very complicated to get rid of that trojan.sirefef.FY and I really wonder when BD will solve our problem. I am following this topic for more then a week now, with some fake solutions suggested by BD.

I have up-graded my old BD security 2011 to BD total security 2013 and since than I even got more problems.

I fully agree with mister Greenhorn, I got more and more skipped files during scan and also some are protected by password. I never ever used any password to protect any file.

Mariadescarte thanks for your post. However I am fearful to try software I am unfamiliar with. Hackers will often offer malicious software that poses as solutions, that can introduce more infections

Hello

First of all, thank you for your feedback!

I did read carefully all the post since my last intervention here.

Now, regarding skipped items and password protected items, please read these topics:

http://forum.bitdefender.com/index.php?showtopic=33812

http://forum.bitdefender.com/index.php?showtopic=33810

@ Michelebelge

From the received logs, there a no leftovers from the Sirefef infection.

You have the link with the explication regarding password protected items.

@ Greenhorn

Mariadescarte's post was deleted because it was posted by a bot.

Now, I received those logs, bot they are all from last month, none of the scan logs is from August.

I've searched more information regarding MAL_XIN12 & JAVA_DLOAD.ZW. The first one is part of the Sirefef family, as you mentioned and the second one is a Java Exploit.

Please clear Java cache:

http://www.java.com/en/download/help/plugin_cache.xml

Go to Control Panel an uninstall all the current versions and install Java 7 Update 5.

http://www.oracle.com/technetwork/java/jav...ad-1591157.html

For 32 bit systems install jre-7u5-windows-i586.exe

For 64 bit systems, please install jre-7u5-windows-i586.exe and jre-7u4-windows-x64.exe (in this order).

Download and install the software and then run it to clean your computer's registry and temporary files:

http://download.piriform.com/ccsetup321.exe

http://www.piriform.com/docs/ccleaner/usin...gistry-cleaning

Once the cleaning is complete it's recommended to restart your computer.

If you have a registry cleaner already installed, you can use that one.

Now, please run a System Scan and send me via PM only the scan log generated at the end of the scanning process.

You have all the details over here:

http://forum.bitdefender.com/index.php?showtopic=36507

Attach the XML file in a PM or post it over here.

Thank you very much for your patience and understanding!

Have a great day!

Bit defender wasn’t detecting or removing any malwere on my netbook whether it be using the bit defender program, the suggested bit defender tools or the online bit defender scanner. However I suspected it was still infected, so I used an online scanner from a competitor and it found and removed the following infections.

Mal_Xin12

JAVA_AGENT.JFK

JAVA_AGENT.MM

JAVA_AGENT.MN

TROJ_GEN.RCBC7GQ

On my desktop desktop after I upgraded to the defender 2013, the bit defender program no longer detected or removed Trojans. I suspected that the infections were still there, because the previous version of the defender would find an quarantine, that would often respawn after rebooting and rescanning. Also the behavior of the computer seem to suggest that there still was one or more infections.

Before I tried the competitor that found the two infections that I posted yesterday. I managed to get Windows defender working by using restore. Though Windows defender is generally an inferior product, I gave it a shot anyway and gave the system a full scan after an update. Sure enough it found a possible rogue program. While the security industry doesn’t classify the program as malwere, fortunately Windows defender detected the file and gave me the option to quarantine it, so I did. It could be a false positive. Adware:win32/open

Mariadescarte's post was deleted because it was posted by a bot.

I'm not so sure it was a bot. But I don't blame you for removing it. The post seemede very suspicious; possibly a scammer spamming fake security software loaded with malware. Even if it was legitimate software, it would be unethical to post a link that breaks a reasonable and wise forum rule.

Now, I received those logs, bot they are all from last month, none of the scan logs is from August.

I've sent many logs, but have received no solutions.

Attach the XML file in a PM or post it over here.

I might do that, but I suspect it is futile, because since I've upgraded to bit defender 2013 it hasn't removed or quarantined any files. On the first few scans it did red flag files, but for some reason it didn't clean, quarantine or remove those files; yet on subsequent scans it hasn't found any malicious software other than cookies. So I don't think I have any XML scan log files that would be useful. I suspect the scan logs are typically only useful if the software detects suspicious or malicious files.

I sent you those new logs as requested, however I don't think they're going to be much use, because bit defender did not detect, fix, inoculate or delete the infections.

However I still haven't received a solution from all the other scan logs I sent even from as far back as a month ago, before I upgraded and bit defender often detected malicious software.

Thanks for the directions on Java etc..

Hello

Thank you for the logs.

Without those files that are detected by the other scanner, I can not give you a verdict.

Did you remove them? If not, please check the scan log from that scanner(I think it should appear at the end of the scan or if you click on the names) and look for the path.

Pack the files flagged as

Mal_Xin12

JAVA_AGENT.JFK

JAVA_AGENT.MM

JAVA_AGENT.MN

TROJ_GEN.RCBC7GQ

in an archive and send it over for analysis.

After my colleagues will analyze those files, I can provide you a verdict(some of them could be False Positives from that company) and if needed, detection will be added in Bitdefender.

Send me please the active with those files via sendspace.com or any other file server.

Thank you for your patience and for the cooperation with BitDefender team!

Hello

Thank you for the logs.

Without those files that are detected by the other scanner, I can not give you a verdict.

Did you remove them? If not, please check the scan log from that scanner(I think it should appear at the end of the scan or if you click on the names) and look for the path.

Pack the files flagged as

in an archive and send it over for analysis.

After my colleagues will analyze those files, I can provide you a verdict(some of them could be False Positives from that company) and if needed, detection will be added in Bitdefender.

Send me please the active with those files via sendspace.com or any other file server.

Thank you for your patience and for the cooperation with BitDefender team!

I was using an online scanner, the items were put into a quarantine and I don't know how to access them without restoring the files that are probably malicious back on to my computer to reinfect it (I'm not going to do that). Your request comes too late. Perhaps if you would've asked after I cleaned my first computer, but before I cleaned the second computer.

I don't know what you mean but it sounds like you want me to send you the infected files. I'm not familiar with the terminology/jargon you are using. My knowledge of computers is extremely limited.

They could be false positives, but I doubt it because the performance and behavior of both of my computers has improved since removing/quarantining the suspected files.

Hopefully my computers are now malware free. So hopefully now we can proceed with repairing the damage to my Windows files, if I can find or borrow a Windows CD.

When bit defender was finding the files and quarantining them, I was using the bit defender option on the 2011 version to submit quarantine items. As I previously told you, I couldn't figure out how to prompt the defender 2012 to submit quarantined items. I had it set to automatically submit quarantined items, but even though I had it selected, quarantined items were not being submitted. Quite some time ago I asked you if there was a way to resolve that issue, but you never answered.

It seems that many people have the same infections that I have had. If they haven't all given up and gone to other companies, then hopefully one of them will submit the samples you are requesting.

If I recall correctly the quarantined items were submitted to the company that provided the scan that I used.

I've scanned both of my computers with both bit defender, and the competitor and so far my computer has turned up clean except for the usual cookies. So far both of the computers are behaving better, but still not as good as before the infections.

It seems that now that the suspect files have been quarantined/removed, that bit defender seems to be skipping substantially less files when it is scanning.

Hello

I am glad to hear that.

In about 5 minutes I will send you a PM message. Please reply back with the requested data.

Thank you very much!

Quick Links