Both browsers in Win 7 reporting false errors and odd login screens


  1. Posts : 12
    Windows 7 Ultimate
       #1

    Both browsers in Win 7 reporting false errors and odd login screens


    I have thoroughly searched my answer everywhere..I promise... when I try to log in Ebay where it is supposed to have my username, it has a bunch of symbols!
    So when I try to log in, I get the symbols in autopopulate, and at the same time this started. the browsers started returning "cookies not enabled" errors. But they are enabled, Everything is updated, I don't understand how it is on every browser on my computer, I can log in elsewhere fine.

    And I have these entries in my about:config in Firefox one is quite long (see below)

    I may not be in the right place, but if anyone would be kind enough to direct me to the right place. This started a week ago, I can log in from another computer fine.

    Updated Java
    Updated Windows
    Uninstalled IE and FF deleted profiles reinstalled
    removed all addons/themes/toolbars/
    ran antivirus scan

    about:config in FF has the entries in the first picture, , but I can not find WAJAM anywhere besides there
    The fourth line down in the picture actually is quite long, and it reads as follows
    ` "extensions.wajam.trace_log;1361846650237 - processInstallationUpgrade - version set to : 1.26
    1361846650238 - processBrowserLoad - Bad mappingListJsonString: null
    1361846652852 - onFlagInfoReceived - JSON Received: {"unique_id":"A2B697018234AD036EBDFAFB5009BBC1","urls_mapping_version":"0.21084","send_debug_info":f alse}
    1361846652853 - onFlagInfoReceived - Server mapping version: 0.21084
    1361846652854 - onFlagInfoReceived - No client-side server mapping version, don't update
    1361846652856 - onFlagInfoReceived - Saving server mapping version
    1361846652859 - onFlagInfoReceived - No user current mapping version specified, set to '0'
    1361846652860 - onFlagInfoReceived - Unique ID saved"enter code here `


    Anyway I hope I am in the right place.. Thanks in advance, if you need anything else let me know, If I am in the wrong neighborhood I would appreciate it if someone would let me know.
    Attached Thumbnails Attached Thumbnails Both browsers in Win 7 reporting false errors and odd login screens-abconfig-wajam.png   Both browsers in Win 7 reporting false errors and odd login screens-ebay-welcome.png  
      My Computer


  2. Posts : 1,618
    Win7 Home Premium x64 W10Pro&Home
       #2

    http://downloads.malwarebytes.org/mbam-download.php download and install the free version of malwarebytes...sounds like you been hijacked...
      My Computer


  3. Posts : 12
    Windows 7 Ultimate
    Thread Starter
       #3

    Thank you, I will try it right now.
      My Computer


  4. Posts : 12
    Windows 7 Ultimate
    Thread Starter
       #4

    Getting worse


    Well It has got worse, MSE found 4 files and deleted called
    Trojan:Win32/Sirefef.AN
    Trojan:Win64/Sirefef.AG
    Trojan:Win64/Sirefef.W
    Trojan:Win64/Sirefef


    Yet still no browsers working, and 2 entries wound up in the Browser config. since last reboot.... here is 1

    Code:
    extensions.wajam.supported_sites.google.wajam_google_se_js;try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';window['WAJAM_PATH'] = 'http://www.wajam.com/'; window['WAJAM_PATH_ADS'] = 'http://ads.wajam.com/'; window['WAJAM_PATH_NEW_ADS'] = 'http://social-ads.wajam.com'; window['WAJAM_CONTAINER_HEIGHT'] = '225px'; window['WAJAM_BROWSER'] = 'f'; window['WAJAM_BROWSER_VERSION'] = '1.26'; window['WAJAM_AFFILIATE'] = '6447';window['WAJAM_ENV'] = '0'; window['WAJAM_PLATFORM'] = navigator.platform;window['WAJAM_SEARCH_ENGINE'] = 'google'; window['WAJAM_SERVER_VERSION'] = '1.00262.0'; window['WAJAM_SUPPORT_CRC32_MAPPING'] = '0'; window['WAJAM_SHOULD_SEE_ADS'] = true; window['WAJAM_ID_USER'] = '0'; window['WAJAM_LATITUDE'] = '38.0964';window['WAJAM_LONGITUDE'] = '-94.3611';window['WAJAM_NEW_ADS_SERVERS'] = false;window['WAJAM_SOCIAL_ADS'] = false;window['WAJAM_ADS_COUNT_TOP'] = 3;window['WAJAM_ADS_COUNT_SIDE'] = 0;window['WAJAM_COUNTRY_CODE'] = 'US';window['WAJAM_MAPPING_VERSION'] = '0.21084'; window['WAJAM_USER_MAPPING_VERSION'] = '0';window['WAJAM_UNIQUE_ID'] = 'A2B697018234AD036EBDFAFB5009BBC1'; window['WAJAM_VISITOR_UNIQUE_ID'] = '13618478064085626'; window['WAJAM_AB_TEST_1'] = '5';window['WAJAM_WAJAM_EMPLOYEE'] = false;if (priam_utils_loaded === undefined) {
        var priam_utils_loaded = true;
        var priamAppName = window['APP_LABEL_NAME'];
        var priamAppNameFullUC = window['APP_LABEL_NAME_FULL_UC'];
        var priamAppNameUC = window[priamAppNameFullUC + '_APP_LABEL_NAME_UC'];
    
        /*
         * Write log to console (if there is one (Firebug / Chrome))
         */
        function priamDebug(text) {
            if (window['console'] !== undefined && window['console'].log !== undefined && window[priamAppNameFullUC + '_ENV'] == 1) {
                console.log(text);
            }
        }
        
        /*
         * Called when server detects that our javascript version is outdated and
         * forces an addon refresh.
         */
        function priamForceAddonReloadJavascript() {
            priamDebug('Forcing server-side javascript reload!');
            
            if (document.createEvent) {                
                // dispatch for firefox + others
    Code:
    
                        
                        if (priamjQuery.browser.msie && priamjQuery.browser.version == 7) {
                            priamjQuery('#priam_top_ads').css({
                                background: '#FFF8E7',
                                width: '527px'
                            });
                        }
                    }
    
                    this.top_ads_timeout = setTimeout(_.bind(function(){
                        this.topTimeout(ads);
                    },this),1);
                },
                
                topTimeout: function(ads){
                    if (priamjQuery('#priam_top_ads').length == 0) {
                        this.insertTopAds(ads);
                    }
                    else {
                        if ((priamjQuery('#priam_top_ads').is(':hidden') || priamjQuery('#priam_top_ads').css('visibility') == 'hidden') && priamjQuery('#center_col').is(':visible') && priamjQuery('#center_col').css('visibility') != 'hidden') {
                            this.get('/this_should_never_be_called',{
                                params: {
                                    reason: 'ads_hidden',
                                    current_url: document.location.href
                                }
                            });
                        }
    
                        // Make sure we're on top, change it maximum 3 times
                        if (this.ads_switch < 3 && priamjQuery('#center_col').children().length > 0 && priamjQuery('#center_col').children().first().attr('id') != 'priam_top_ads') {
                            priamjQuery('#center_col').prepend(priamjQuery('#priam_top_ads'));
                            this.ads_switch++;
                        }
                    
                        this.top_ads_timeout = setTimeout(_.bind(function(){
                            this.topTimeout(ads);
                        },this),300);
                    }
                },
                
                insertSideAds: function(ads){
                    this.log('Insert Side Ads');
                    
                    if (this.side_ads_timeout) {
                        clearTimeout(this.side_ads_timeout);
                    }
                    
                    priamjQuery('#priam_side_ads').remove();
                    priamjQuery('#priam_wrapper').after(_.template(this.templates.ads.side,{ads:ads,se: this.se}));
                    
                    this.side_ads_timeout = setTimeout(_.bind(function(){
                        this.sideTimeout(ads);
                    },this),1);
                },
                
                sideTimeout: function(ads){
                    if (priamjQuery('#priam_side_ads').length == 0) {
                        this.insertSideAds(ads);
                    }
                    else {
                        this.side_ads_timeout = setTimeout(_.bind(function(){
                            this.sideTimeout(ads);
                        },this),10);
                    }
                },
    
                isSearchReady: function(){
                    return ( priamjQuery('#subform_ctrl').length == 1 && priamjQuery('#subform_ctrl').css('visibility') !== 'hidden' );
                },
                
                isGoogleResultsReady: function() {
                    return this.isSearchReady() && (priamjQuery('#ires').length > 0 || priamjQuery('#topstuff').length > 0);
                },
                
                trackSearch: function() {
                    if (!this.isSearchReady()) {
                        this.log('trackSearch canceled by isSearchReady');
                        return;
                    }
                    
                    this.log('trackSearch');                 
                    
                    this.sendTrackSearch();
                },
                
                sendTrackSearch: function() {
                    if (this.isGoogleResultsReady()) {
                        var kw = priamjQuery('input[name=q]').val(),
                                sr = priamjQuery('#ires').length > 0,
                                sa = priamjQuery('#tads').length > 0,
                                mp = priamjQuery('.kno-map').length > 0,
                                ss = priamjQuery('a.spell').text(),
                                ci = priamjQuery('#knop').length > 0;
    
                        this.track_id++;
                                
                        this.get('/searchengine/track/search',{
                            nocache: true,
                            params: {
                                call_id: this.track_id,
                                kw: kw,
                                sr: sr,
                                sa: sa,
                                mp: mp,
                                ss: ss,
                                ci: ci
                            }
                        });
                    }
                    else {
                        var self = this;
                        setTimeout(function() {
                            self.sendTrackSearch();
                        }, 500);
                    }
                },
    
                getExtraSearchBoxEvents: function() {
                    if (typeof this.start_param == 'undefined') {
                        this.start_param = '';
                    }
                    var start_param = priamExtractUrlParameter(document.location.href,'start');
                    if (this.start_param != start_param) {
                        this.start_param = start_param;
                        return true;
                    }
                    return false;
                }
            });
            
            // dont initialise multiple times
            if (priamSearchEngine) {
                priamSearchEngine.reloadAdsFooter();
                return;
            }
            
            priamSearchEngine = new Priam();
            if (window[window['APP_LABEL_NAME_FULL_UC']+'_ENV'] == '1') {
                window.priamSearchEngine = priamSearchEngine;
            }
            
            priamSearchEngine.init({
                se: 'google'
            });
        }
        catch(e){
            priam_tracing.trace('insertion_failed');
            if (priamSearchEngine) {
                priamSearchEngine.log(e,e.stack);
            }
        }
    })(priamjQuery);var _gaq =  _gaq || [];
                      _gaq.push(["priam._setAccount", tracking_code]);
                      _gaq.push(["priam._setDomainName", "none"]);
                      _gaq.push(["priam._setAllowLinker", true]);
                        (function() {
                            var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;
                            ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";
                            var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);
                        })();} catch (ex) {
                var vDebug = "";
                for (var prop in ex) {
                   vDebug += "property: "+ prop+ " value: ["+ ex[prop]+ "]";
                }
                vDebug += "toString(): " + " value: [" + ex.toString() + "]";
    
                if (priamReportError !== undefined)
                    priamReportError(vDebug, true);
            }
    
    Are these just a coincidence? Because I would have thought MSE or Malwarebytes would find more than 4 files.. Any other suggestions would be helpful, thanks

    OK here is SOME of the code, the actual code was a little longer.. Is it normal to have this (see picture) on one line in about:config?


      My Computer


  5. Posts : 12
    Windows 7 Ultimate
    Thread Starter
       #5

    I am thinking it would be better to dig out my Win install disk, I have already lost Windows Defender, Firewall, WIM, and can not update... it's just getting worse
    Attached Thumbnails Attached Thumbnails Both browsers in Win 7 reporting false errors and odd login screens-word-count.png  
      My Computer


  6. Posts : 2,963
    Windows 7 Professional SP1 64-bit
       #6

    Sirefef can be a nasty piece of work. If you do not have a backup to restore from, reinstalling would be the safest bet to make sure it is truly gone.
      My Computer


  7. Posts : 12
    Windows 7 Ultimate
    Thread Starter
       #7

    Petey7 said:
    Sirefef can be a nasty piece of work. If you do not have a backup to restore from, reinstalling would be the safest bet to make sure it is truly gone.

    Thank you, I am in the process of reinstalling now, It is my nieces laptop, hard to say where she got it.

    I tell em and tell em.. but they see something shiny and click away!
      My Computer


  8. Posts : 2,963
    Windows 7 Professional SP1 64-bit
       #8

    What antivirus does she use? I recommend using MSE and MBAM Pro. MBAM Pro has a malicious IP blocker which can reduce the risk of her getting a virus from clicking random links, and it doesn't interfere with other antivirus/malware programs while giving you a second layer of protection.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 18:38.
Find Us