infected by Trojan-GameThief.Win32.Magania.bfwj

[ctu_la]

Hi everybody! i have experienced serious troubles lately (blue screens issues) and suspected some kind of infection. I've executed the Kaspersky virus removal tool and here are the results :

Detected
--------
Status Object
------ ------
will be deleted when the computer is restarted: Trojan program Trojan-GameThief.Win32.Magania.bfyj File: C:\WINDOWS\system32\nmdfgds0.dll
deleted: Trojan program Trojan-GameThief.Win32.Magania.bfwj File: c:\sm.exe
deleted: Trojan program Trojan-GameThief.Win32.Magania.bfwj File: d:\sm.exe
deleted: Trojan program Trojan-GameThief.Win32.Magania.bfwj File: c:\windows\system32\olhrwef.exe

Obviously it hasn't removed these infected files as i have done another scan and they are still on my computer. So i executed the Manual Cure procedure. You will find the report attached to this post. For your information, the restoration function of windows is disabled.

Many thanks for sending me a script to execute.

[Aleksandra]

1. Please, disable System Restore and antivirus (if you have).
2. Execute the script in AVPTool:

begin
ClearHostsFile;
SetAVZGuardStatus(True);
 RegKeyIntParamWrite('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun', 221);
 QuarantineFile('C:\sm.exe','');
 DeleteFile('C:\autorun.inf');
 DeleteFile('C:\sm.exe');
 DeleteFile('D:\autorun.inf');
 DeleteFile('D:\sm.exe');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteWizard('TSW', 3, 3, true);
BC_Activate;
CreateQurantineArchive('C:\quarantine.zip');
RebootWindows(true);
end.

After restart upload file C:\quarantine.zip, by link http://virusinfo.info/upload_virus.php?tid=59020

3. Attach a new avptool_syscheck.zip.