Windows : Virus and trojan

Tak · 30-07-2012, 08:17

So this morning when I turned my pc on, it seems I've got unwelcome guests. They are called sirefef.ab and sirefef.a and I don't know what to do.

My PC is now rebooting every 1 minute, couldn't even shut it down properly.

I am close to tears at the thought of having to format and lose everything. So many photos

Please remember I am an idiot so any explanations or ideas will need to be idiot guide style.

Haven't a clue where it came from; I'm usually so careful

leowyatt · 30-07-2012, 16:07

Ok, can you boot into safe mode?

Tak · 30-07-2012, 17:12

Nope - did the same thing

Tak · 30-07-2012, 19:14

Ended up putting windows onto a different drive and booting from that. Seems lots of people are being hit by this ATM :/ it really is a nasty one.

Zirax · 30-07-2012, 20:19

Is this the wrong time to offer to come over to fix your pc and check your plumbing?

I would have suggested moving it over with a fresh install. Then scanning the drive of the spare drive.

Are you running the following:-
Avast / AVG
Comodo
Hosts file replacement
Spybot
Ad block plus in firefox

leowyatt · 30-07-2012, 20:36

Another one to try is combo fix

Davey_Pitch · 31-07-2012, 02:31

For info, if Windows is shutting itself down or rebooting when you boot it up, you can generally stop it by doing the following....

Click Start -> Run -> shutdown -a

That aborts the shutdown sequence (hit Windows key + r if you don't have Run on your start menu). That would then give you a chance to use whatever virus/spyware removal tools you can get your hands on to try to get rid of the offending files.

Tak · 31-07-2012, 08:51

Davey - that didn't work; Mic tried it a few times, including in safe mode. It still shut down.
Other things I've read about it; it creates copies of itself and hides them in audio files. Re-infection after "fixes" seem very normal. It can "show" an image of whatever file it took over when scanned by anti virus so they don't detect it.

I have now put avast on - I was using mse after recommendations here so its all your fault

I've still got some drivers and stuff to sort out but will then be looking at drop box for photo security in future.

30-07-2012, 08:17	#1
Tak L'Oréal Join Date: Jul 2006 Location: Portsmouth Posts: 9,977	Virus and trojan So this morning when I turned my pc on, it seems I've got unwelcome guests. They are called sirefef.ab and sirefef.a and I don't know what to do. My PC is now rebooting every 1 minute, couldn't even shut it down properly. I am close to tears at the thought of having to format and lose everything. So many photos Please remember I am an idiot so any explanations or ideas will need to be idiot guide style. Haven't a clue where it came from; I'm usually so careful __________________ The look on your face when a toddler rips out your heart and shows it to you? Priceless.... For everything else, there's FWOOSH!

30-07-2012, 16:07	#2
leowyatt Chef extraordinaire Join Date: Jul 2006 Location: Infinite Loop Posts: 11,143	Ok, can you boot into safe mode? __________________ "Dr Sheldon Cooper FTW!"

30-07-2012, 17:12	#3
Tak L'Oréal Join Date: Jul 2006 Location: Portsmouth Posts: 9,977	Nope - did the same thing __________________ The look on your face when a toddler rips out your heart and shows it to you? Priceless.... For everything else, there's FWOOSH!

30-07-2012, 19:14	#4
Tak L'Oréal Join Date: Jul 2006 Location: Portsmouth Posts: 9,977	Ended up putting windows onto a different drive and booting from that. Seems lots of people are being hit by this ATM :/ it really is a nasty one. __________________ The look on your face when a toddler rips out your heart and shows it to you? Priceless.... For everything else, there's FWOOSH!

30-07-2012, 20:36	#6
leowyatt Chef extraordinaire Join Date: Jul 2006 Location: Infinite Loop Posts: 11,143	Another one to try is combo fix __________________ "Dr Sheldon Cooper FTW!"

30-07-2012, 20:19	#5
Zirax Goes up to 11! Join Date: Jul 2006 Posts: 4,577	Is this the wrong time to offer to come over to fix your pc and check your plumbing? I would have suggested moving it over with a fresh install. Then scanning the drive of the spare drive. Are you running the following:- Avast / AVG Comodo Hosts file replacement Spybot Ad block plus in firefox

31-07-2012, 02:31	#7
Davey_Pitch I iz speshul Join Date: Jun 2006 Location: Liverpool Posts: 6,296	For info, if Windows is shutting itself down or rebooting when you boot it up, you can generally stop it by doing the following.... Click Start -> Run -> shutdown -a That aborts the shutdown sequence (hit Windows key + r if you don't have Run on your start menu). That would then give you a chance to use whatever virus/spyware removal tools you can get your hands on to try to get rid of the offending files. __________________ Our deepest fear is not that we are inadequate. Our deepest fear is that we are powerful beyond measure. It is our light, not our darkness, that most frightens us. Your playing small does not serve the world. There is nothing enlightened about shrinking so that other people won't feel insecure around you. We are all meant to shine as children do. It's not just in some of us; it is in everyone. And as we let our own lights shine, we unconsciously give other people permission to do the same. As we are liberated from our own fear, our presence automatically liberates others.

31-07-2012, 08:51	#8
Tak L'Oréal Join Date: Jul 2006 Location: Portsmouth Posts: 9,977	Davey - that didn't work; Mic tried it a few times, including in safe mode. It still shut down. Other things I've read about it; it creates copies of itself and hides them in audio files. Re-infection after "fixes" seem very normal. It can "show" an image of whatever file it took over when scanned by anti virus so they don't detect it. I have now put avast on - I was using mse after recommendations here so its all your fault I've still got some drivers and stuff to sort out but will then be looking at drop box for photo security in future. __________________ The look on your face when a toddler rips out your heart and shows it to you? Priceless.... For everything else, there's FWOOSH!