Solved Both browsers in Win 7 reporting false errors and odd login screens

[shanuck]

I have thoroughly searched my answer everywhere..I promise... when I try to log in Ebay where it is supposed to have my username, it has a bunch of symbols!
So when I try to log in, I get the symbols in autopopulate, and at the same time this started. the browsers started returning "cookies not enabled" errors. But they are enabled, Everything is updated, I don't understand how it is on every browser on my computer, I can log in elsewhere fine.

And I have these entries in my about:config in Firefox one is quite long (see below)

I may not be in the right place, but if anyone would be kind enough to direct me to the right place. This started a week ago, I can log in from another computer fine.

Updated Java
Updated Windows
Uninstalled IE and FF deleted profiles reinstalled
removed all addons/themes/toolbars/
ran antivirus scan

about:config in FF has the entries in the first picture, , but I can not find WAJAM anywhere besides there
The fourth line down in the picture actually is quite long, and it reads as follows
` "extensions.wajam.trace_log;1361846650237 - processInstallationUpgrade - version set to : 1.26
1361846650238 - processBrowserLoad - Bad mappingListJsonString: null
1361846652852 - onFlagInfoReceived - JSON Received: {"unique_id":"A2B697018234AD036EBDFAFB5009BBC1","urls_mapping_version":"0.21084","send_debug_info":false}
1361846652853 - onFlagInfoReceived - Server mapping version: 0.21084
1361846652854 - onFlagInfoReceived - No client-side server mapping version, don't update
1361846652856 - onFlagInfoReceived - Saving server mapping version
1361846652859 - onFlagInfoReceived - No user current mapping version specified, set to '0'
1361846652860 - onFlagInfoReceived - Unique ID saved"enter code here `

Anyway I hope I am in the right place.. Thanks in advance, if you need anything else let me know, If I am in the wrong neighborhood I would appreciate it if someone would let me know.

 

[DMHolt57]

http://downloads.malwarebytes.org/mbam-download.php download and install the free version of malwarebytes...sounds like you been hijacked...

 

[shanuck]

Thank you, I will try it right now.

 

[shanuck]

Getting worse

Well It has got worse, MSE found 4 files and deleted called
Trojan:Win32/Sirefef.AN
Trojan:Win64/Sirefef.AG
Trojan:Win64/Sirefef.W
Trojan:Win64/Sirefef

Yet still no browsers working, and 2 entries wound up in the Browser config. since last reboot.... here is 1

extensions.wajam.supported_sites.google.wajam_google_se_js;try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';window['WAJAM_PATH'] = 'http://www.wajam.com/'; window['WAJAM_PATH_ADS'] = 'http://ads.wajam.com/'; window['WAJAM_PATH_NEW_ADS'] = 'http://social-ads.wajam.com'; window['WAJAM_CONTAINER_HEIGHT'] = '225px'; window['WAJAM_BROWSER'] = 'f'; window['WAJAM_BROWSER_VERSION'] = '1.26'; window['WAJAM_AFFILIATE'] = '6447';window['WAJAM_ENV'] = '0'; window['WAJAM_PLATFORM'] = navigator.platform;window['WAJAM_SEARCH_ENGINE'] = 'google'; window['WAJAM_SERVER_VERSION'] = '1.00262.0'; window['WAJAM_SUPPORT_CRC32_MAPPING'] = '0'; window['WAJAM_SHOULD_SEE_ADS'] = true; window['WAJAM_ID_USER'] = '0'; window['WAJAM_LATITUDE'] = '38.0964';window['WAJAM_LONGITUDE'] = '-94.3611';window['WAJAM_NEW_ADS_SERVERS'] = false;window['WAJAM_SOCIAL_ADS'] = false;window['WAJAM_ADS_COUNT_TOP'] = 3;window['WAJAM_ADS_COUNT_SIDE'] = 0;window['WAJAM_COUNTRY_CODE'] = 'US';window['WAJAM_MAPPING_VERSION'] = '0.21084'; window['WAJAM_USER_MAPPING_VERSION'] = '0';window['WAJAM_UNIQUE_ID'] = 'A2B697018234AD036EBDFAFB5009BBC1'; window['WAJAM_VISITOR_UNIQUE_ID'] = '13618478064085626'; window['WAJAM_AB_TEST_1'] = '5';window['WAJAM_WAJAM_EMPLOYEE'] = false;if (priam_utils_loaded === undefined) {
    var priam_utils_loaded = true;
    var priamAppName = window['APP_LABEL_NAME'];
    var priamAppNameFullUC = window['APP_LABEL_NAME_FULL_UC'];
    var priamAppNameUC = window[priamAppNameFullUC + '_APP_LABEL_NAME_UC'];

    /*
     * Write log to console (if there is one (Firebug / Chrome))
     */
    function priamDebug(text) {
        if (window['console'] !== undefined && window['console'].log !== undefined && window[priamAppNameFullUC + '_ENV'] == 1) {
            console.log(text);
        }
    }
    
    /*
     * Called when server detects that our javascript version is outdated and
     * forces an addon refresh.
     */
    function priamForceAddonReloadJavascript() {
        priamDebug('Forcing server-side javascript reload!');
        
        if (document.createEvent) {                
            // dispatch for firefox + others

[/COLOR][COLOR=DarkGreen]
                    
                    if (priamjQuery.browser.msie && priamjQuery.browser.version == 7) {
                        priamjQuery('#priam_top_ads').css({
                            background: '#FFF8E7',
                            width: '527px'
                        });
                    }
                }

                this.top_ads_timeout = setTimeout(_.bind(function(){
                    this.topTimeout(ads);
                },this),1);
            },
            
            topTimeout: function(ads){
                if (priamjQuery('#priam_top_ads').length == 0) {
                    this.insertTopAds(ads);
                }
                else {
                    if ((priamjQuery('#priam_top_ads').is(':hidden') || priamjQuery('#priam_top_ads').css('visibility') == 'hidden') && priamjQuery('#center_col').is(':visible') && priamjQuery('#center_col').css('visibility') != 'hidden') {
                        this.get('/this_should_never_be_called',{
                            params: {
                                reason: 'ads_hidden',
                                current_url: document.location.href
                            }
                        });
                    }

                    // Make sure we're on top, change it maximum 3 times
                    if (this.ads_switch < 3 && priamjQuery('#center_col').children().length > 0 && priamjQuery('#center_col').children().first().attr('id') != 'priam_top_ads') {
                        priamjQuery('#center_col').prepend(priamjQuery('#priam_top_ads'));
                        this.ads_switch++;
                    }
                
                    this.top_ads_timeout = setTimeout(_.bind(function(){
                        this.topTimeout(ads);
                    },this),300);
                }
            },
            
            insertSideAds: function(ads){
                this.log('Insert Side Ads');
                
                if (this.side_ads_timeout) {
                    clearTimeout(this.side_ads_timeout);
                }
                
                priamjQuery('#priam_side_ads').remove();
                priamjQuery('#priam_wrapper').after(_.template(this.templates.ads.side,{ads:ads,se: this.se}));
                
                this.side_ads_timeout = setTimeout(_.bind(function(){
                    this.sideTimeout(ads);
                },this),1);
            },
            
            sideTimeout: function(ads){
                if (priamjQuery('#priam_side_ads').length == 0) {
                    this.insertSideAds(ads);
                }
                else {
                    this.side_ads_timeout = setTimeout(_.bind(function(){
                        this.sideTimeout(ads);
                    },this),10);
                }
            },

            isSearchReady: function(){
                return ( priamjQuery('#subform_ctrl').length == 1 && priamjQuery('#subform_ctrl').css('visibility') !== 'hidden' );
            },
            
            isGoogleResultsReady: function() {
                return this.isSearchReady() && (priamjQuery('#ires').length > 0 || priamjQuery('#topstuff').length > 0);
            },
            
            trackSearch: function() {
                if (!this.isSearchReady()) {
                    this.log('trackSearch canceled by isSearchReady');
                    return;
                }
                
                this.log('trackSearch');                 
                
                this.sendTrackSearch();
            },
            
            sendTrackSearch: function() {
                if (this.isGoogleResultsReady()) {
                    var kw = priamjQuery('input[name=q]').val(),
                            sr = priamjQuery('#ires').length > 0,
                            sa = priamjQuery('#tads').length > 0,
                            mp = priamjQuery('.kno-map').length > 0,
                            ss = priamjQuery('a.spell').text(),
                            ci = priamjQuery('#knop').length > 0;

                    this.track_id++;
                            
                    this.get('/searchengine/track/search',{
                        nocache: true,
                        params: {
                            call_id: this.track_id,
                            kw: kw,
                            sr: sr,
                            sa: sa,
                            mp: mp,
                            ss: ss,
                            ci: ci
                        }
                    });
                }
                else {
                    var self = this;
                    setTimeout(function() {
                        self.sendTrackSearch();
                    }, 500);
                }
            },

            getExtraSearchBoxEvents: function() {
                if (typeof this.start_param == 'undefined') {
                    this.start_param = '';
                }
                var start_param = priamExtractUrlParameter(document.location.href,'start');
                if (this.start_param != start_param) {
                    this.start_param = start_param;
                    return true;
                }
                return false;
            }
        });
        
        // dont initialise multiple times
        if (priamSearchEngine) {
            priamSearchEngine.reloadAdsFooter();
            return;
        }
        
        priamSearchEngine = new Priam();
        if (window[window['APP_LABEL_NAME_FULL_UC']+'_ENV'] == '1') {
            window.priamSearchEngine = priamSearchEngine;
        }
        
        priamSearchEngine.init({
            se: 'google'
        });
    }
    catch(e){
        priam_tracing.trace('insertion_failed');
        if (priamSearchEngine) {
            priamSearchEngine.log(e,e.stack);
        }
    }
})(priamjQuery);var _gaq =  _gaq || [];
                  _gaq.push(["priam._setAccount", tracking_code]);
                  _gaq.push(["priam._setDomainName", "none"]);
                  _gaq.push(["priam._setAllowLinker", true]);
                    (function() {
                        var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;
                        ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";
                        var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);
                    })();} catch (ex) {
            var vDebug = "";
            for (var prop in ex) {
               vDebug += "property: "+ prop+ " value: ["+ ex[prop]+ "]";
            }
            vDebug += "toString(): " + " value: [" + ex.toString() + "]";

            if (priamReportError !== undefined)
                priamReportError(vDebug, true);
        }
[/COLOR]

Are these just a coincidence? Because I would have thought MSE or Malwarebytes would find more than 4 files.. Any other suggestions would be helpful, thanks

OK here is SOME of the code, the actual code was a little longer.. Is it normal to have this (see picture) on one line in about:config?

 

[shanuck]

I am thinking it would be better to dig out my Win install disk, I have already lost Windows Defender, Firewall, WIM, and can not update... it's just getting worse

 

[Petey7]

Sirefef can be a nasty piece of work. If you do not have a backup to restore from, reinstalling would be the safest bet to make sure it is truly gone.

 

[shanuck]

Sirefef can be a nasty piece of work. If you do not have a backup to restore from, reinstalling would be the safest bet to make sure it is truly gone.

Thank you, I am in the process of reinstalling now, It is my nieces laptop, hard to say where she got it.

I tell em and tell em.. but they see something shiny and click away! :banghead:

 

[Petey7]

What antivirus does she use? I recommend using MSE and MBAM Pro. MBAM Pro has a malicious IP blocker which can reduce the risk of her getting a virus from clicking random links, and it doesn't interfere with other antivirus/malware programs while giving you a second layer of protection.