Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Sirefef.P and possibly others

  • This topic is locked This topic is locked
2 replies to this topic

#1 nxctt


  • Members
  • 12 posts
  • Local time:08:32 PM

Posted 09 August 2012 - 07:10 AM

Ok, so last night I was browsing the internet and a certain page caused Microsoft Security Essentials to give me a notification that it detected something and cleaned it. I opened MSE and checked the "All-detected items" under the history tab and found that it removed something called Sirefef.P. Since then, i've removed it from the history, but i'm pretty sure it was in the C:/Users/Owner/AppData/Local/Temp folder and it was an .exe file with a lot of numbers in it. I'm not sure if this is typical but there were no buttons to click on when MSE gave me that message in the corner of the screen. Just an X to close it. Sorry I don't have a screenshot of it but it must have been a real MSE one since the detected file was in the history tab. A couple of Java processes ran when I opened the page where it was detected, that made me think that there was something wrong with it so I uninstalled Java and installed the latest versions. I also ran MBAM and it didn't detect anything. I've also used CCleaner to clear Temporary Files and just about everything else that I could with it.

By the way, I didn't notice anything unusual during all of this, and the computer hasn't rebooted on its own or anything. I did get a message about updating Adobe Reader at some point, which I did, but I assume it's unrelated because the Java Platform SE Auto Updater was re-enabled in the msconfig Startup tab, because I re-installed Java. Is that what caused the update? I'm pretty sure I had something like that disabled before which would explain why I got prompted for the update even though the latest version is apparently several months old.

Still, I want to make sure there are no more infections on my computer.

Earlier tonight I booted into safe mode and did scans with MSE and MBAM again. MSE found an exploit called CVE-2012-1723.dm, which I assume was taken care of and i've removed it from the history. MBAM found nothing again. I rebooted into normal mode.

Then I did something that is widely ill-advised by running ComboFix, because I thought I could handle it. In the "Other Deletions" part of the log, there are 4 files. If possible, could I PM the log to one of the helpers around here? I don't like the idea of posting computer logs for just anyone to see. I haven't removed ComboFix yet so I assume the quarantined files are still fine and can be restored if needed.

And if there's anything else I should do, please tell me. I'm running Windows 7 64-bit.

Edited by nxctt, 09 August 2012 - 07:38 AM.

BC AdBot (Login to Remove)


#2 narenxp


  • BC Advisor
  • 16,371 posts
  • Gender:Male
  • Location:India
  • Local time:08:32 PM

Posted 09 August 2012 - 07:24 AM

Combofix logs are not allowed here

Read the guide here on preparing logs


and create a topic here


Good luck

#3 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Moderator
  • 37,046 posts
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:08:32 PM

Posted 09 August 2012 - 02:07 PM

Please follow the instructions in my reply to your topic here: http://www.bleepingcomputer.com/forums/topic464493.html

Please note: you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom :cherry:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Internet Security, NoScript Firefox ext.


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users