WIN32 SIREFEF AHF & WIN32 MALWARE-GEN

Viruses and worms
1

Hello.
After booting my laptop on monday I was bombarded by trojan horse warnings, specifically win32 sirefef-ahf and win32 malware-gen. These warnings flag up every 40 seconds or so. Avast seems to parry the virus but I’d much prefer to be rid of it. If anyone has any ideas on how to clean the thing out I’d be deeply appreciative.

2

Please attach your logs. (MBAM, OTL and aswMBR…!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0

3

Sorry, heres the otl log now. It was too large to be sent as an attachment so i’ve compressed it.

http://www.mediafire.com/download.php?gnfdygk99ep434k

4

Hello,RyuzakiBreak! Also we need in MBAM and aswMBR logs!

5

Apologies for the delay. My system is getting really sluggish. Here are the logs as requested.

6

Hi lets get to work

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:Reg [HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32] ""="%systemroot%\system32\wbem\wbemess.dll" [-HKCU\Software\Classes\clsid\{12d0253a-7c96-815c-11e0-3034bbd97cc0}]

:Files
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini
C:\Windows\Installer{3bbce705-b9f0-5f1f-57ca-d8e695802325}
C:\Users\Mark Gallagher\AppData\Local{3bbce705-b9f0-5f1f-57ca-d8e695802325}
ipconfig /flushdns /c
netsh int ip reset c:\resetlog.txt /c
ipconfig /release /c
ipconfig /renew /c

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

FINALLY

run farbar service scanner

https://dl.dropbox.com/u/73555776/FSS.GIF

Tick “All” options.
Press “Scan”.
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

7

When OTL was running the fix, it began ‘Not Responding’ at CREATERESTOREPOINT. Is it safe to just restart the fix?

8

Yes stop OTL and continue to the next part