TechSpot

Sirefef.A virus shuts down computer

By Ludifex
Jul 2, 2012
  1. I've been infected with the Sirefef.A virus. Every time I boot up my computer, it restarts the computer within a minute, preventing me from trying to remove it. I've used Microsoft Offline Defender to try and get at it, but it has had no effect so far. Any advice is very appreciated.
     
  2. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==============================================

    What Windows version is it?
     
  3. Ludifex

    Ludifex TS Rookie Topic Starter

    It's a Windows Vista 64 bit.
     
  4. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
    For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options.

    To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    To enter System Recovery Options by using Windows installation disc:
    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.

    On the System Recovery Options menu you will get the following options:

      • Startup Repair
        System Restore
        Windows Complete PC Restore
        Windows Memory Diagnostic Tool
        Command Prompt
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
     
  5. Ludifex

    Ludifex TS Rookie Topic Starter

    I got to the Advanced Boot Options menu, and selected Repair Your Computer, and pressed enter. Instead of bringing up further options, the computer just went ahead and loaded the normal screen where a user puts in their password, and from there it loaded the desktop normally. Then the virus shut down the computer again.
     
  6. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Please retry.
     
  7. Ludifex

    Ludifex TS Rookie Topic Starter

    I'm on my sixth try now. Same story every time. After selecting Repair Your Computer, windows just boots up normally, and then shuts down after a minute.
     
  8. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Do you have Vista DVD?
     
  9. Ludifex

    Ludifex TS Rookie Topic Starter

    I have the Vista installation burned onto 2 DVDs. Unfortunately, the CD drive on the computer is broken, and I don't have any other CD drives.
     
  10. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Not good :(

    When exactly did the whole issue start?

    ===================================

    You will need a USB flash drive.

    Download GETxPUD.exe to the desktop of your clean computer
    • Run GETxPUD.exe
    • A new folder will appear on the desktop.
    • Open the GETxPUD folder and click on the get&burn.bat
    • The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
    • Click on Start and follow the prompts to burn the image to a CD.
    • Next download rst.sh to your USB flash drive
    • Remove the USB & CD and insert it in the sick computer
    • Boot the Sick computer with the CD you just burned
    • The computer must be set to boot from the CD
    • Gently tap F12 and choose to boot from the CD
    • Follow the prompts
    • A Welcome to xPUD screen will appear
    • Press File
    • Expand mnt
    • sda1,2...usually corresponds to your HDD
    • sdb1 is likely your USB
    • Click on the folder that represents your USB drive (sdb1 ?)
    • Confirm that you see rst.sh that you downloaded there
    • Press Tool at the top
    • Choose Open Terminal
    • Type bash rst.sh
    • Press Enter
    • After it has finished a report will be located on your USB drive named enum.log
    • Remove the USB drive and insert it back in your working computer and navigate to enum.log

      Please note - all text entries are case sensitive
    Copy and paste the enum.log for my review
     
  11. Ludifex

    Ludifex TS Rookie Topic Starter

    Hey guys, it ended up being easier to just install windows 8 from a flash drive over Vista. Wiped out the virus, and I get to try a new operating system! Your help was really appreciated.
     
  12. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Thanks for letting me know :)
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...