F\P....Adsl Software Limited (Rogue.MalWarrior)

[TeMerc]

From support user:

Malwarebytes' Anti-Malware 1.34Database version: 1764Windows 5.1.2600 Service Pack 3
2/15/2009 9:43:39 PMmbam-log-2009-02-15 (21-43-39).txt
Scan type: Quick ScanObjects scanned: 128320Time elapsed: 44 minute(s), 22 second(s)
Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 1Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0
Memory Processes Infected:(No malicious items detected)
Memory Modules Infected:(No malicious items detected)
Registry Keys Infected:HKEY_CURRENT_USER\SOFTWARE\Adsl Software Limited (Rogue.MalWarrior) -> Delete on reboot. [385753513430414438586436545151384753645452385161524839535634513861346984770152807185886683700145747874857069]
Registry Values Infected:(No malicious items detected)
Registry Data Items Infected:(No malicious items detected)
Folders Infected:(No malicious items detected)
Files Infected:(No malicious items detected)

[nosirrah]

This has been in defs for at least 4 months with no reports and I can confirm multiple rogues using this location .

I need to know if the user has any evidence that there is legit software using the same location .

[TeMerc]

Ok, the issue now isn't so much it's a f\p, but that we're not removing it.

The last scan log is db v 1764, have there been any changes to this that she should update and it would be gone?

[nosirrah]

There have not been any changes to this def . It is likely that they had this family of malware st some point in the past and whatever they used to clean it up missed this trace .

[TeMerc]

There have not been any changes to this def . It is likely that they had this family of malware st some point in the past and whatever they used to clean it up missed this trace .

Ok, but why don't we remove it? Have permissions been borked on that key by the other software?

[nosirrah]

Our new permissions code should fix it with ease . Do they have teatimer or other reg protection software installed ?

[TeMerc]

Our new permissions code should fix it with ease . Do they have teatimer or other reg protection software installed ?

Just Defender and one other forget at the moment, but both disabled.

I'll have her double check tho

[TeMerc]

Just Defender and one other forget at the moment, but both disabled.

I'll have her double check tho

Double checked, she even had removed Norton so there's noting running in so far as protection.

I even went so far as to get another dev log w\current db version.