I got infected with whatever Trojan keeps spawning the above virus… I have run Avast Internet Security several times and Malwarebytes several times. Both scans come back clean, but virus keeps respawning as soon as I reboot… From other postings, it appears that the fix for this virus is PC specific, so can some one help me out? I have attached the Malwarebytes log, what else do I need?
follow this guide and attach (not copy and paste) logs from Malwarebytes / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0
all logs attached…
Hi punkwood2k, welcome to the forum.
To make cleaning this machine easier
[*]Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
[*]Please do not run any scans other than those requested
[*]Please follow all instructions in the order posted
[*]All logs/reports, etc… must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
[*]Do not attach any logs/reports, etc… unless specifically requested to do so.
[*]If you have problems with or do not understand the instructions, Please ask before continuing.
[*]Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.
Download ComboFix from one of these locations:
* IMPORTANT !!! Save ComboFix.exe to your Desktop
[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
[*]Right click on ComboFix.exe, click Run as Administrator & follow the prompts.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1.Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer’s settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
4. If after running combofix you recieve an message “Illegal operation attempted on a registery key that has been marked for deletion” or similar reboot the computer.
Please post back with the combofix log.
Thanks
ComboFix.txt attached. 
Hi punkwood2k,
How’s the computer?
Please follow all previous instructions regarding security programs.
Open a new Notepad session
[*]Click the Start button, click run
[*]in the run box type notepad
[*]click ok
[*]In the notepad, Click “Format” and be certain that Word Wrap is not checked.
[*]Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE
Files::
C:\Users\Donkeypunch\AppData\Local\{50a922b6-59af-5cf6-8e97-0d48ffb16594}\@
Folder::
c:\windows\Installer\{50a922b6-59af-5cf6-8e97-0d48ffb16594}\U
c:\windows\Installer\{50a922b6-59af-5cf6-8e97-0d48ffb16594}\L
c:\windows\Installer\{50a922b6-59af-5cf6-8e97-0d48ffb16594}
C:\Users\Donkeypunch\AppData\Local\{50a922b6-59af-5cf6-8e97-0d48ffb16594}
In the notepad
[*]Click File, Save as…, and set the Save in to your Desktop
[*]In the filename box, type (including quotation marks) as the filename: “CFScript.txt”
[*]Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.
This will start ComboFix again.Close all browser/windows first.
Note: Do not mouseclick combofix’s window while it’s running. That may cause it to stall
2nd combo fix attached…
Avast hasnt flagged anymore of the above virus. Seems to be good to go now.
Hi punkwood2k,
We’ll clean up the tools.
From your desktop, please delete, if present
[]any notepads/logs that we created
[]aswMBR
Next
Click the Start button. Copy and paste the following line into the search box and click OK
Combofix /uninstall
Next
Locate the copy of OTL that we renamed to iexplorer.exe. Open it then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.
I suggest you keep MBAM. Keep it updated and use it regularly.
Updates and Upgrades
Your java is out of date. Click your start button > Control Panel > Programs > Uninstall a program Uninstall
Java™ 6 Update 27 (64-bit)
Java™ 6 Update 31
You can download and install both the 32bit and 64 bit versions from HERE . You want the last 2 files in the list, jre-7u5-windows-i586.exe and jre-7u5-windows-x64.exe
After you download them double click them to install.
Next, clear the java cache
To clear the Java Plug-in cache:
[*]Click Start > Control Panel.
[*]Double-click the Java icon in the control panel.
[*]On the General tab, Click Settings under Temporary Internet Files.
[*]On the Temporary Files Settings screen, Click Delete Files.
[*]check all boxes
[*]Click OK
.
Some Recommendations and prevention tips
Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Those you have now.
* A guide to understanding and using the hosts file.
Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS
Please read the info on disabling the DNS Client before installing a custom hosts file.
-Secure your Internet Explorer
From within Internet Explorer click on the Tools menu and then click on Options.
[*]Click once on the Security tab
[*]Click once on the Internet icon so it becomes highlighted.
[*]Click once on the Custom Level button.
[*]Change the Download signed ActiveX controls to Prompt
[*]Change the Download unsigned ActiveX controls to Disable
[*]Change the Initialize and script ActiveX controls not marked as safe to Disable
[*]Change the Installation of desktop items to Prompt
[*]Change the Launching programs and files in an IFRAME to Prompt
[*]Change the Navigate sub-frames across different domains to Prompt
[*]When all these settings have been made, click on the OK button.
[*]If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
-
Make sure you have reset Windows Updates to your chosen option. Click your start button > Control Panel > System > Windows updates (lower left) > change settings
-
Keep your antivirus program updated, as well as any other security programs you have.
-More tips and programs can be found HERE
Please post back if you have any problems.
Take care