Win32:Malware-gen

[njwhitworth]

Hello,

My system is infected with Win32:Malware-gen and I have followed the instructions at http://forum.avast.com/index.php?topic=53253.0

Please see the attached log files.

Thanks
Nick

[njwhitworth]

Here's the last log file.

Thanks in advance

Nick

[magna86]

Hi,




Please download zoek.zip or zoek.rar by smeenk () from here or here and save it to your Desktop.
Unpack the archive...

• Close any open browsers
• Temporarily disable your AntiVirus program. (If necessary)
  If you are unsure how to do this please read this or this Instruction.
  
  
• Double click on zoek.exe to run the tool .
  Please wait while the tool does not start...
  
  
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:

Code: [Select]

EmptyCLSID;
CHRDefaults;
FFDefaults;
AutoClean;

• Click on button.
  Please wait until a logreport will open (this can be after reboot)
  
  
• Save notepad to your Desktop and attach here zoek-results.log
  Note: It will also create a log in the C:\ directory named "zoek-results.log"
  

THEN ...





1. Please download ComboFix by sUBs () from here and save it to your Desktop.
If you are unsure how ComboFix works, read this guide.

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

Instructions how to disable avast:
• Right click on the avast! system tray icon () in the lower right corner of the screen and scroll up to avast! shield controls;
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note:  Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.

--------------------------------------------------------------------
3. Run ComboFix. Then, on disclaimer window, click I Agree! button.

- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
- If malware is detected, ComboFix will begin with its removal, and may need to restart Windows.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt)
=> Attach log report (ComboFix.txt) back to topic.

ComboFix shall also create addition log (typical location: C:\Qoobox\ComboFix-quarantined-files.txt)
=> Please attach that report (ComboFix-quarantined-files.txt) as well.

[njwhitworth]

Hi,

I tried to run the Zoek tool but no code box appeared.  All that happened was a pop up appeared which said my system would reboot within a minute.  I couldn't find any log files either.

I ran ComboFix and the results are attached.

Thanks
Nick

[magna86]

Hi,


Could you please delete the zoek tool and download the fresh one from the links above and try to re-run zoek but this time with this zoekscript:

Code: [Select]

QuickScan;
Zoek shall preform the diagnostic and create the zoek log (C:\zoek-results.log). Please post that log here...

[njwhitworth]

Hi,

Downloaded the tool again and same thing happens - no application window opens and PC reboots.  NO log file to be found.

Regards
Nick

[magna86]

Hi,

Could you please try to run this zoek script? Then, when zoek finish his scan to post me his created log...

Code: [Select]

FilesRCM;
StartUpAll;
FirefoxLook;
ChromeLook;
Btw, you need to be patient with zoek ... run the tool ... wait to be loaded... paste & run script ...wait for him to finish his scan.

[njwhitworth]

How can I run the script? When I double click zoek.exe my PC reboots.

[magna86]

Huh . . then just post me the fresh OTL log. QuickScan will do.

[njwhitworth]

Here it is.

Thanks

[magna86]

These set of logs are clean. There is no malicious activity.
Recommendation to reset all your browser back on their defaults. You can apply that action via their settings. Use google to find out how.


• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
Remove disinfection tools
Create registry backup
Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.






Cheers

[njwhitworth]

Great, thank you very much for your help, it's much appreciated:-)

[magna86]