Win32:Sirefef-PL [Rtk]

[mattk42]

C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini
In the beginning, in succession, avast would pop up saying it had blocked malware and then a trojan. After running malwarebits only the popup about the trojan is happening. It's still occurring every ten or so minutes.

Once this is all cleaned up do I need to be worried about my passwords and such?

Thanks in advance! I really appreciate the help!

[mattk42]

After reading some  other threads, I think I'm just going to reinstall windows. I have one hard drive in two partitions. One with windows, the other with all my docs and files. Do I need to be worried about this rootkit infecting the docs and files partition? Or will I be safe with just formatting and reinstalling on C:\? Thanks!

[SafeSurf]

Yes, you need to be worried with a rootkit.

I am going to refer you to our Certified Malware expert, named Essexboy.  He will also review your logs and give you further instructions, however he comes on the forum late UK time weekdays but sometimes earlier on weekends.  He will respond to you in this thread, so remember to check this thread daily.

Please do not make any further changes to your machine after you have provided the logs.

IMPORTANT: If you are on a home network, disconnect the affected machine from the network.  Do not share a USB/flash drive with this affected machine.  Do not use this machine unless Essexboy instructs you do to malware removal instructions; use a different machine to check email, sync your phone or other devices.

Let us know if you have any questions.  Thank you.

[essexboy]

Combofix should repair the security centre and firewall, if it does not let me know

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

  :Files
  C:\Windows\assembly\GAC_32\Desktop.ini
  C:\Windows\assembly\GAC_64\Desktop.ini
  C:\Windows\Installer\{e9e7d038-a255-6baa-454d-3a998a833d88}
  C:\Users\Matthew\AppData\Local\{e9e7d038-a255-6baa-454d-3a998a833d88}
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[mattk42]

Oh, sorry, you must have missed my other post. I went ahead and reinstall windows last night, because I wanted to get my comp back to running. I have one hard drive in two partitions. One with windows, the other with all my docs and files. I formatted and reinstalled windows, should I be worried that the root kit jumped to my other partition? I ran a full scan with avast once I got it back and running. Nothing was found.

[essexboy]

No this one will not survive a reformat..  Glad you are fixed though

[mattk42]

Good to know! Thanks! Glad I set up my drive that way.