Win32.Buzus.amit / svchost fake - local and external drives

I identified the problem about a week ago, but I could have been infected long before that. There was a hidden RECYCLER folder in my root directory and the system seemed to be slowing down. A NortonAntiVir-scan registered a Trojan.Horse-svchost.exe in that folder but couldn't do anything about it.

Spybot didn't find anything during the regular scan, but when I used it on that folder specifically, the heuristic analysis detected Win32.buzus.amit in desktop.ini - but again, no action could be taken.

Going through your Read & Run Me, ComboFix seems to have removed the folder, but there's no perceivable change in system performance and my task manager still shows seven svchost processes running.

Additionally and unfortunately, the infection spread to an external drive and a flash drive via autorun before I even discovered the threat. Now I have no problem with setting up my notebook anew if necessary, but no idea how to disinfect the large external drive without massive data loss.

Help would be much appreciated.

 

I followed the instructions, but there are still strange RECYCLER folders on both external drives and I still can't delete them.

There are also still several svchost exes running and the system is still going slow, although I'm not sure anymore if I can blame that solely on malware.

 

I guess you're right. The RECYCLER folders are in the root directories of the external drives, and they contain recycle bins named S-1-5-21-1966764565-2189706233-4176665243-1006 or something similar.

The only thing I find odd is that after I ran ComboFix, the RECYCLER folder on my C drive disappeared, and didn't reappear until I plugged in the external.