Win32: bagel infection & WFSINTWQ.SYS

Hi folks

I have Windows Home XP Service Pack 3, fully up to date.

I turned on the PC thismorning to find that my avast antivirus had not started up with Windows as normal.
I tried to turn it on manually, and got the dreaded "this is not a valid win32 application" error.

After some research, it appears to be a bagel win32 virus. I don't have much experience with removing malware as I have a weekly procedure which has kept my machine clean for the 4 years ive had it without a glitch. The missus was job hunting yesterday, so guessing its been picked up then.

I have been through the read me and the xp cleaning guide:

1) I have carried out the basic computer maintenance except for CC Cleaner (i use this on a weekly basis but it refuses to open due to this infection).
2) I only have avast antivirus protection - nothing else.
3) I have removed anything that relates to viewpoint, removed all old java updates, emptied quarantied folders etc (cant run cc cleaner)
4) enabled all hidden files, folders, opened msconfig, stopped anything that was illegitimate (flec003 was the virus name in the start up tab)
5) there were no malware managed to install itself as a program
6) XP Cleaning procedure:

1) downloaded SAS
2) everytime I tried to open the site to download malwarebytes my browser closed (this is the case for GMER aswell...it seems to recognise some sites that would help and just closes them)
3) got combofix - wont run - not valid win32 app error
4) downloaded rootrepeal & MGtools. will attach logs when I get home from work
5) SAS would not run - same as cc cleaner, when you click to open nothing happens - no errors
6) same for Malwarebytes (I could not download this as explained in step 2 but realised I already had this installed)

I did run the SAS online scanner. This started, but then I got a blue STOP screen with a reference to WFSINTWQ.SYS which seems to be a critical file in the virus.
I also managed to download and run the mcafee stinger, which gave me the reference to the bagel win32.

I thank you in advance for any advice given and will attach the logs to rootrepeal & MGtools asap.

Jamie

 

Hi Tim

When I went home to follow your instructions my PC would not boot in any mode. Tried booting into recovery console, executing a few checkdisks etc but it wouldnt boot so I had to do a fresh install. Luckily I had backup up personal info a few weeks earlier.

Thanks again for your time

Jamie