After downloading a torrent i have been infected by a virus. It started with windows security center not being able to switched on anymore and i was getting win64/patched.A errors in AVG. I downloaded Avast which blocks files every 10 minute from being installed.
I downloaded malwarebytes and just finished scanning, it found 3 files. Will restart computer now and generate the other logs.
Monitoring
edit-
@MouzurX
Please attach your logs into reply, don’t paste them. 
I’m not finding the “additional options” area where i’m suppose to attach files.
Adwcleaner doesn’t find anything the log says.
Running OTL now.
Please, do attach all your logs. Can you see this ?
“Attachments and other options”
http://www.mcshield.net/personal/magna86/Images/avast%20attach%20post.png
For some reason i see it now although i knew exactly where to find it earlier(feels like a “is it plugged in?” computer support customer :D)
Attached logs.
AswMBR is running now.
And here is the last log.
Seems to be the sirefef thing where some other topics are about as well.
So what should i do? 
Anyone? in an other topic i see its either format harddisk or using combofix or something?
Hi,
You need to be patient! I do have my private life. I’m doing this on a voluntary basis, and if I said I’ll help, then I will help you.
Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.
Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.
How to disable avast:
[*]Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
[*]In the window that opens on the top right corner, click Settings.
[*]In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
[*]Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn on this option after the cleaning.
Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix’s window while it is running.
If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart computer once more.
When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
Attach log reports ( ComboFix.txt) back to topic.
======== Next =========
Please download zoek.exe and save it to your desktop.
[*] Close any open browsers.
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.
[*] Double click on zoek.exe to run the tool .
Please wait while the tool does not start…
[*] Copy the text present inside the code box below and paste it into the large window in the zoek tool:
process;
srinfo;
{A3BC75A2-1F87-4686-AA43-5347D756017C};c
{A3BC75A2-1F87-4686-AA43-5347D756017C};c
mswsock.dll;z
systemscpecs;
C:\PROGRAMDATA\AVG SECURE SEARCH;f
installedprogs;
C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll;virustotal
{CCC7A320-B3CA-4199-B1A6-9F516DD69829};c
C:\Windows\SysWOW64\MPG4ds32.ax;i
C:\Windows\SysWOW64\msadds32.ax;i
C:\Users\Mauser\AppData\Local\Programs;vs
DIR /S /A:L "%systemdrive%\*">>"%temp%\log.txt";b
C:\Windows\Installer\{c60d1430-734f-fd1d-2598-d70c97516b7c};f
C:\Windows\system32\services.exe;i
C:\Windows\SysNative\services.exe;i
filesrcm;
startupall;
C:\Windows\assembly\GAC_32\Desktop.ini;f
C:\Windows\assembly\GAC_64\Desktop.ini;f
bhghfmljekyiaiiglvwiohfyuywprpci;a
skipfix-iedefaults;
firefoxlook;
chromelook;
[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button
Please wait until a logreport will open (this can be after reboot)
[*] Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”
I apologize, I was a bit impatient. 
I ran combofix and it repaired the services file, zoek however i’ve been unable to run. It gave an error that it is for 32 bit computers (i have 64 bit).
Combo log attached. I’m not getting messages from avast anymore. So maby its fixed? Thank you for your help.
Hi,
We still have some staff to do …
FileLook::
c:\users\Mauser\AppData\Roaming\Microsoft\Installer\{BCD55450-77AC-4347-B24F-654B1189F8D4}\IconF7A21AF7.exe
c:\windows\system32\Services.exe
KillAll::
DirLook::
C:\sh4ldr
Folder::
c:\windows\Installer\{c60d1430-734f-fd1d-2598-d70c97516b7c}
ClearJavaCache::
DDS::
Trusted Zone: mosw.com\free-game-downloads
Firefox::
FF - ProfilePath - c:\users\Mauser\AppData\Roaming\Mozilla\Firefox\Profiles\3g2ataa6.default\
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B6b9123fe-bdf5-4f2b-bc65-5648b77dbcb3%7D&mid=3a5e5a934301bd39a44e3702a87ebf83-b37e62b12a406af088f0833ac2f61dab295adc9e&ds=AVG&v=11.1.0.7&lang=nl&pr=fr&d=2011-12-03%2017%3A13%3A03&sap=ku&q=
Save this as CFScript.txt
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:[b]ComboFix.txt[/b] )
============= Next ============
zoek however i've been unable to run. It gave an error that it is for 32 bit computers (i have 64 bit).
I need additional check:
Can you please try to run zoek one more time using this script.
Download fresh zoek.exe and try to run. Or try with zip-ed.
installedprogs;
bhghfmljekyiaiiglvwiohfyuywprpci;a
C:\Users\Mauser\AppData\Local\Programs;vs
C:\Windows\SysWOW64\MPG4ds32.ax;i
C:\Windows\SysWOW64\msadds32.ax;i
mswsock.dll;z
filesrcm;
startupall;
skipfix-iedefaults;
firefoxlook;
chromelook;
Attach log here.
If you fail to run zoek, then run this tool:
Please download Farbar Recovery Scan Tool and save it to your desktop.
[color=green]Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.
[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Here are the logs.
Zoek worked this time.
Hi,
Control Panel > Programs and Features > uninstall Hotspot Shield 1.52 ( if is there )
Then, re-run this zoek script:
emptyclsid;
c:\sh4ldr;f
C:\Windows\BCD5545077AC4347B24F654B1189F8D4.TMP;f
FFdefaults;
chrdefaults;
C:\users\Mauser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter;vs
shortcutfix;
resetIEproxy;
{F9E4A054-E9B1-4BC3-83A3-76A1AE736170};c
c:\program files (x86)\Hotspot Shield;fs
resethosts;
ipconfig /flushdns >> %temp%\log.txt;b
emptyalltemp;
autoclean;
======= Next =======
C:\AdwCleaner[R1].txt
Re-run AdwCleaner and click on Delete button. Attach here log.
How is your computer running now?
When i tried to uninstall hotspotshield it said it was already removed and it removed it out of the program list now.
Computer works great, no more reports from AVG.
You think that removed it completely? Last time i download anything that isn’t seeded by a lot of people ;D
[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
[*] In the line of text type in (Copy) the following:
ComboFix /Uninstall
Note that there is a space between " ComboFix " and " /Uninstall " .
[*] then click OK (or press Enter ).
Wait for the uninstall process is complete.
Run the tool and check the following boxes below;
[] Remove disinfection tools
[] Create registry backup
[*] Purge System Restore
Now click on “Run” button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt
I don’t need DelFix log report.
MyCity - Official download link
Softpedija - Mirror download link
It will prevent infection by computer via USB flash drive, mobile phone or any other memory card.
And not only will prevent infection, but it will immediately clean flash drive, memory card or external HDD.
Done!
Excellent. Thanks a lot for your help, apologize again for impatience ;D
That’s OK. Be safe.