C:\Windows\assembly\GAC_32\Desktop.ini Threat: Win32:Sirefef-FQ [Drp]

[anusmyn]

According to avast! I am still infected with this:
C:\Windows\assembly\GAC_32\Desktop.ini      Threat: Win32:Sirefef-FQ [Drp]
 

[anusmyn]

...?

[DavidR]

It may still be a remnant, but are you getting any of the other symptoms ?

Unfortunately it is 1:05am in the UK so essexboy will be in bed and normally back on the forums after work about 7pm UK time.

[essexboy]

Could you re-run an OTL please with the following script

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
  
• Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
C:\Windows\assembly\GAC_32\*.ini
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Post both logs

[anusmyn]

Here is the OTL log.

[anusmyn]

Here is the extras log.

[essexboy]

Hmm that showed one file that should not be there

color=green]Download and Install Combofix[/color]
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[anusmyn]

Sorry, I was away on holidays and had no access to a computer.
Here is the log from Combofix.

[anusmyn]

Help!

[DavidR]

Because of the delay essexboy may not be subscribed to this topic, I will PM him to notify.

I'm afraid that you may be in for a little time zone ping pong as it 1:42pm in the UK and essexboy may not be back in the forums until later in the day around 7pm.

[essexboy]

Hi there are the alerts still occuring ?

[DavidR]

Thought you would be at work essexboy

[essexboy]

Nope taking a few days off 

[anusmyn]

Scan finds this:
C:\_OTL\MovedFiles\12182011_132538\C_Windows\...Destop.ini Threat Win32:Sirefef-FQ [Drp]

[essexboy]

That is the OTL quarantined file

Any other problems ?