win32 virus? installer folder malware tmp files? help plz

[TrueBurner]

i need help, recently my avast was popping up saying it was blocking a virus but it kept popping up, i did a scan and removed everything it detected but it kept popping up still, started looking into it and i believe i have the win32 trojan virus, i did a scan with malwarebytes and a ton of files were detected in my Windows/Installer/{8b10e36f-a44a-9367-be7e-2d0fd9595060}/U folder, all tmp files, random numbers and letters for title such as trz1A2.tmp or trz1A2F.tmp,
no idea whats going on or anything

[essexboy]

Hi there you have zero access

Download OTL  to your Desktop
Secondary link

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

• Select All Users
  
• Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Post  both logs

THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan 




On completion of the scan click save log, save it to your desktop and post in your next reply

[TrueBurner]

OTL only saved one file, here the files are

[TrueBurner]

Heres the OTL file

[essexboy]

OK lets kill this

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
O2:64bit: - BHO: (DataMngr) - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\BROWSE~1.DLL File not found
O2 - BHO: (DataMngr) - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\BROWSE~1.DLL File not found
O3 - HKLM\..\Toolbar: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - Startup: C:\Users\DevinDevilTrueBurner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\trz7A62.tmp ()
O4 - Startup: C:\Users\DevinDevilTrueBurner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\trz7F53.tmp ()
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll) - File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\datamngr.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - File not found
[2013/01/18 12:34:37 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2013/01/18 12:34:02 | 000,000,159 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.reg
[2013/01/18 12:34:02 | 000,000,069 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.bat
[2013/01/07 19:05:33 | 016,972,048 | ---- | C] () -- C:\Users\DevinDevilTrueBurner\R248560.exe
[2013/01/07 19:05:29 | 002,502,624 | ---- | C] () -- C:\Users\DevinDevilTrueBurner\R232275.exe
[2013/01/18 14:17:37 | 000,000,544 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-1437999286-3063623459-4148351772-1001\$II1WUT1.@
[2013/01/18 14:16:53 | 000,000,544 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-1437999286-3063623459-4148351772-1001\$IRCH6L3.@
[2013/01/18 13:25:12 | 000,005,120 | ---- | M] () -- C:\Windows\assembly\GAC_32\Desktop.ini
[2013/01/18 13:25:12 | 000,006,144 | ---- | M] () -- C:\Windows\assembly\GAC_64\Desktop.ini

:Files
C:\Windows\Installer\{8b10e36f-a44a-9367-be7e-2d0fd9595060}
C:\Users\DevinDevilTrueBurner\AppData\Local\{8b10e36f-a44a-9367-be7e-2d0fd9595060}

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

FINALLY

CLEAR THE BAD TOOLBARS

Download AdwCleaner from here to your desktop
Run AdwCleaner and select Delete



Once done it will ask to reboot, allow this
On reboot a log will be produced please attach that

[TrueBurner]

heres the logs

[essexboy]

How is the computer now ? Any further problems

[TrueBurner]

seems to be better, thank you very much for your help !!

[essexboy]

If all is well tomorrow let me know and I will tidy up and remove my tools

[TrueBurner]

ok will do