need HELP! with removal of win32Malware-gen

[lemonwater16]

Hello, sometime ago i went to travel somewhere for a week and came back, my computer got this virus!
It was fine when i left my computer and it's very annoying now, avast keep detecting it twice everytime i open a new tab on Internet Explorer(and it seems to be fine with Firefox)
I really need some help with the removal of this nasty virus, can someone help me please? Thank You

[mikaelrask]

hey and welcome to the forum.

plaese follow this guide and attach your logs

http://forum.avast.com/index.php?topic=53253.0

could you also provided a pic of that url from avast.

[lemonwater16]

here are the logs and the picture
thank you very much!

[lemonwater16]

please help i'm afraid this will get worse since i saw some desktop.ini popping up everywhere
thank you

[Pondus]

Malware removers are notified, it may take hours before one arrive so be patient.....also consider what time of year it is   

[essexboy]

The desktop files are system files and will be re-hidden on completion

After this run can you let me know if you are still getting the alerts

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.selectedEngine: "Facemoods Search"
FF - prefs.js..browser.startup.homepage: "http://start.facemoods.com/?a=bf2"
FF - prefs.js..extensions.enabledAddons: ffxtlbr@Facemoods.com:1.2.6
FF - prefs.js..extensions.enabledAddons: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3
FF - prefs.js..extensions.enabledAddons: wtxpcom@mybrowserbar.com:6.6
FF - prefs.js..extensions.enabledAddons: ytd@mybrowserbar.com:6.6
[2011/08/22 15:52:36 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\uog3e3c1.default\extensions\ffxtlbr@Facemoods.com
[2011/02/08 12:25:36 | 000,000,000 | ---D | M] (Mitter Toolbar) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\uog3e3c1.default\extensions\tagiritoolbar@tagiri.jp
[2011/06/23 18:30:02 | 000,004,669 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\uog3e3c1.default\extensions\ffxtlbr@Facemoods.com\content\xpiInstallLgc.js

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[lemonwater16]

Thank you very much for helping!!
here is the log and yes im still getting the alerts

[essexboy]

Did you install Thunder network ?

[lemonwater16]

yes i did, is it the source of the virus?

[essexboy]

Could you temporarily uninstall it and let me know if the alerts cease

[lemonwater16]

hello, i have removed the thunder network and the alerts are still popping up

[essexboy]

OK bigger hammer time

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[lemonwater16]

hi, here is the combofix log and i dont know if it matters but when i sign in to my email or facebook etc, the security alert would pop up and it never does that before. and i cant sign in to forums,etc stuff that requires signing in. And the alerts are still popping up as usual

thank you

[essexboy]

This one is elusive and appears to be a programme updater of some sort

• Run OTL. Make sure all other windows are closed and to let it run uninterrupted.

• Select All Users
  
• Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  .
  
  • Post  the log

[lemonwater16]

here is the new log, thank you