JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser .
Solved Malware sirefef.y and similar found in MSE on Vista HP x86
Hi good people,
This closely relates to a very similar thread on the forums here titled " [Solved] Sirefef.y and Sirefef.b - MSE cannot update and PC shuts itself down" Posted by member
By GailMacM
on Jul 1, 2012. The situation was rather deftly resolved by
Broni Malware Annihilator. In the spirit of co-operation I've completed the Farbar (x86) & (x64) downloads and installed them to usb. The only way I could access System Recovery Options was the run an old Windows 32bit boot disk. I've successfully created both and FRST.txt and a Search.txt. The Vista machine is not currently connected to the internet and I have limited ability, at the moment of resolving this. I cannot disengage MSE as the computer wants to restart exactly 1 minut after booting into the GUI. Similarly, for this reason, I haven't been able to revert to older Sys restore points. I have attemted Safe Mode, Safe Mode with networking, and Safe Mode with command prompt under the installed OS System recovery options but to no avail. The end result always being the 1 minute reboot issue. I can re-connect to the Internet at some point but have steered clear of this until one of you good people has a chance to view the text files. I wont paste them as yet but will wait your further instruction. I assume from the posting rules that I needed to make this a new post as per the forum rules and guidelines. My humblest apologies if I have misunderstood any of the conditions.
Regards,
John M
Welcome aboard
Please, observe following rules:
Read all of my instructions very carefully .If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum. I close my topics if you have not replied in 5 days .
=============================================
Go ahead and post FRST.txt and a Search.txt logs.
Thanks Broni,
And here's the Search.txt
You have a different issue.
You have infected partition.
WARNING! Proceed with extreme caution!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Download
GETxPUD.exe to the desktop of your
clean computer
Double click on GETxPUD.exe
A new folder will appear on the desktop.
Open the GETxPUD folder and click on the get&burn.bat
The program will download xpud_0.9.2.iso , and upon finished will open BurnCDCC ready to burn the image.
Insert blank CD into your CD drive.
Click on Start and follow the prompts to burn the image to a CD.
Boot bad computer from the CD
Click Menu then Terminal Emulator
Type parted /dev/sda set 3 boot on
Press Enter
Type parted /dev/sda rm 4
Press Enter
Remove xPUD CD, reboot normally.
===================================================
See if the computer will stay up.
We have some other issues as well.
Thank-you,
Hi again Broni,
New FRST.txt
You will need a USB flash drive.
Download
GETxPUD.exe to the desktop of your clean computer
Run GETxPUD.exe
A new folder will appear on the desktop.
Open the GETxPUD folder and click on the get&burn.bat
The program will download xpud_0.9.2.iso , and upon finished will open BurnCDCC ready to burn the image.
Click on Start and follow the prompts to burn the image to a CD.
Next download rst.sh
Remove the USB & CD and insert it in the sick computer
Boot the Sick computer with the CD you just burned
The computer must be set to boot from the CD
Gently tap F12 and choose to boot from the CD
Follow the prompts
A Welcome to xPUD screen will appear
Press File
Expand mnt
sda1,2...usually corresponds to your HDD
sdb1 is likely your USB
Click on the folder that represents your USB drive (sdb1 ?)
Confirm that you see rst.sh that you downloaded there
Press Tool at the top
Choose Open Terminal
Type bash rst.sh
Press Enter
After it has finished a report will be located on your USB drive named enum.log
Remove the USB drive and insert it back in your working computer and navigate to enum.log Please note - all text entries are case sensitive
Copy and paste the
enum.log for my review
I can confirm that rst.sh has been saved to thumb drive. However, I cannot see it in the mnt folder under any of the sda1 sda2 or sda3 folders. I selected show hidden files and folders... still no joy
Hold on !!
enum log for you review. Sorry about the delay.
All restore point are just recent so it won't work.
Also post all list you can see on your screen.
Hello again and sorry for the delay but have had to use Win 7 image disk to access recovery console.
Type:(<-----that's "zero) .
Yes DISK 0 has "*" in front of it.
Good
Type:
LIST PARTITION
Press Enter.
Let me know what you see on the screen and if any item has a "*" in front of it.
No items have "*" in front of them. List is:
Very well.
It absolutely does sir
Type:
Computer not booting. After BIOS it goes to a screen with the following.
Boot back to System Recovery Options and run FRST.explorer.exe Search button and post the log (Search.txt) it makes to your reply.
TechSpot is dedicated to
computer enthusiasts and power users .
Ask a question and give support.
Join the community here , it only takes a minute.
