Hi, I am new to the forum and if I post anything that should be elsewhere please let me know and I will try to get it posted to the correct locations. I am a computer technician and I have a customer that has an older computer that has gotten very slow. I started running some virus scans on it before optimizing it to make sure it is clean (customer doesn't want to refurbish the system). I ran malwarebytes on it and it found 6 infections originally. 2 of the infections were executable files which were removed without a problem. The other 4 were registry entries that malwarebytes cannot remove, nor can I remove them manually by going into the registry. I have seen these files on other forum posts, but I have not found a definite answer as to how I am supposed to remove them. Any help would be appreciated. - - - - - MWB Log - - - - - - - Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6013 Windows 5.1.2600 Service Pack 3 (Safe Mode) Internet Explorer 7.0.5730.11 03/10/2011 16:59:45 mbam-log-2011-03-10 (16-59-45).txt Scan type: Full scan (C:\|) Objects scanned: 194829 Time elapsed: 18 minute(s), 5 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 4 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Value: bf -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Value: bk -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Value: iu -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Value: mu -> Delete on reboot. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\webselfstorage\gate.exe (Spyware.Passwords) -> Not selected for removal. c:\webselfstorage\gate\gatesystem.exe (Spyware.Passwords) -> Not selected for removal. - - - - - - END Log - - - - - - - NOTE: Even though it says "Delete on reboot." the files are never deleted. This log is from my 3rd scan. When I go into the registry to delete them it says "Unable to delete all specified values." which makes it understandable why MWB isn't removing them. Is there a way to do this or is a refurb my only option?
