Bad infection! Please help!

[therookie]

I'm infected! I run the malwarebytes scan and it finds this:

Registry Data Items Infected:

HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

BUT it keeps coming back! It says quarantined and deleted, then to restart computer and I did. But then my computer runs good for awhile then everything starts slowing down. I do another scan and it's back.

How can I remove this for good?

[GT500]

Do you have Iolo's System Mechanic installed? If I remember right, those registry entries are created by System Mechanic in order to prevent running certain types of scripts and registry fixes. It can make helping someone with cleanup over the Internet a pain in the neck, but Iolo claims that it is done for security reasons (whether or not it actually makes your computer more secure is debatable).

[therookie]

Yes I do have Iolo's System Mechanic installed. So what exactly is going on with this?

[exile360]

Please review item #18 of our FAQ. You can safely have Malwarebytes ignore these detections. IOLO System Mechanic is changing these values to non-default settings and Malwarebytes is detecting them because we've seen infections do the same thing (but for a different purpose, malware does it to prevent the user from running certain file types that are often used for fixing infections, IOLO does it to prevent infections from using those files in any sort of scripted behavior).