Antivir

estelle123

Malwarebytes' Anti-Malware 1.44
Database version: 3737
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000
14/02/2010 11:52:32
mbam-log-2010-02-14 (11-52-32).txt
Scan type: Quick Scan
Objects scanned: 126729
Time elapsed: 9 minute(s), 52 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{d34d56e9-b37b-4c37-a854-1ac144592d5c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d34d56e9-b37b-4c37-a854-1ac144592d5c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d34d56e9-b37b-4c37-a854-1ac144592d5c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\Environment\evapp (Rogue.Antivir2010) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Environment\evuninst (Rogue.Antivir2010) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\Common Files\Uninstall\AV (Rogue.Antivir2010) -> Quarantined and deleted successfully.
Files Infected:
C:\Windows\System32\UpdateCheck.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\Program Files\Common Files\Uninstall\AV\Uninstall.lnk (Rogue.Antivir2010) -> Quarantined and deleted successfully.
C:\Program Files\AV\antivir.exe (Rogue.Antivir2010) -> Quarantined and deleted successfully.

Looks like it has now gone,thank you for your help.

fiddiwebb

Looks like it has now gone

Just to be on the safe side estelle and I know it is a pain but could you restart your computer and run a FULL scan with Malwarebytes again.

Browntoa

Browntoa wrote: »

follow this

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

and post that log file

you still need to follow this..its a trusted web site

Malwarebytes may have left parts of the infection