Critical Error, Restart in One minute, Unable to Safemode

Hi all,

My father is having desktop eMachine with Windows vista 32 bit home. AMD dual core some kind of from eMachine. There was some problem that his pc was getting slower and slower. So I did check his PC but there was no problem found on it as I have scanned it with Norton latest version which is installed on the same machine. Logs were clean. Also having SPYBOT on it. It was showing all clean logs. I have decided to install Microsoft security Essential with that as I did not find any virus/malware prob. As I have been using different kind of Antiviruses on different machines in real life with Microsoft Security essential and did not have any Compatibility issues.

But after installing that I found list of viruses Microsoft Security Essential have detected. Which was having same Virus but with different strings. sirefef.r
sirefef.ag sirefef.ad sirefef.b etc.. list is long.. When Microsoft Security Essential tried to remove it at that time problem started. It quarantined almost half but then System gave Critical Error Msg and gave msg that it will restart in one minute. every time when I start it will restart in 1 minute. Then I have tried safe mode but it worked for twice only then it started giving same error in SAFE MODE too and restarted.

Now Its not giving Safe mode option. Its directly showing a screen and says 'Other user' And asking for ID and Password. Its ridiculous. Because there is no ID and Password set for the system.. Not even for ADMIN purpose as its for simple basic home usage for old folks.. They do not have any recovery disc also.

Also with this it gave SPOOLER problem. And when I have checked system32/ there was no file for it.. It was gone somehow..

Please kindly let me know what to do...

Thank you in advance.

Sirefef is a particularly nasty one.
I wuld recommend a complete reformat and reinstall. - extract the user data using a boot disk and external drive, then do the reformat.

Thank you for your reply. I want that as last resort. Isn't there any other way ? Please let me know if it comes like EUREKA in your mind.. If not then will definitely have to do it. I will wait for 24 hours if I can get other way out.

Thank you once again.

Make sure your temp and windows/temp folders are empty--if not, delete any files there. Login as a different user as this particular virus is profile bound. The main concern here is to stop the program from running so you can then remove it safely. If Vista complains about a temp file being in use and can't delete it, then run task manager to see if you can track it down and stop the running process first.

There is a virus removal tool specifically designed for this virus. Visit Panda Security. It may or may not work, because this virus has a number of variants.

Also, after running that tool I'd download Malwarebytes and run it. It seems to be one of the most thorough virus cleaners on the market. It couldn't hurt to try it out. Additionally, you might want to run SuperAnti-Spyware portable; it's a portable scanner you run from a USB or CD drive.

I really don't believe there is any other option - you obviously have a severly infected system, and it's almost impossible to remove sirefef and be certain it's all gone. You could end up having to go through it all again next week or next month.

If you're determined to try and save the current install, you need to go to a specialist malware removal forum ,a nd see if they can help. www.bleepingcomputer.com may be able to help - or the forums at www.malwarebytes.org

Cytherian said:

I'd download Malwarebytes to address this. It seems to be one of the most thorough virus cleaners on the market. It couldn't hurt to try it out.

Click to expand...

Having used MBAM against sirefef, it does work - but the system was so screwed by the time I got to it that there was nothing I could do with what remained, and I was left with no option but a reformat.