Desktop Security 2010 persists

[rob.]

I have been infected with the false virus scan Desktop Security 2010. I have made numerous attempts to clean my computer of it, unsuccessfully.

I'm running XP pro and McAfee that comes with my ISP (AT&T).

My last attempt for removal consisted of stopping the virus from running using rkill, which seems to close all the windows associated with Desktop Security.

Then ran a full scan using latest update of Malewarebytes' and cleaned out numerous problems, see log below.

Restarted only to have Desktop Security return on startup.

Please help!

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

Database version: 3985

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

4/13/2010 8:54:34 PM

mbam-log-2010-04-13 (20-54-34).txt

Scan type: Full scan (C:\|)

Objects scanned: 260074

Time elapsed: 3 hour(s), 25 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 2

Registry Values Infected: 10

Registry Data Items Infected: 1

Folders Infected: 2

Files Infected: 18

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\taskmgr.dll (Rogue.DesktopSecurity2010) -> Delete on reboot.

Registry Keys Infected:

HKEY_CURRENT_USER\Software\Desktop Security 2010 (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Security 2010 (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\desktop security 2010 (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\securitycenter (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sstqnldrv (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iifdaxdrv (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mlmmjidrv (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mlmmjidrv (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxxurqsys (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nnkjghsys (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nnkjghsys (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell (Rogue.DesktopSecurity2010) -> Delete on reboot.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\Desktop Security 2010.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.

Folders Infected:

C:\Documents and Settings\KF Creative\Start Menu\Programs\Desktop Security 2010 (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010 (Rogue.DesktopSecurity2010) -> Delete on reboot.

Files Infected:

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\Desktop Security 2010.exe (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\securitycenter.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{B3EB70D2-9930-452D-8DDE-D8BB51092D5C}\RP131\A0038184.exe (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Start Menu\Programs\Desktop Security 2010\Activate Desktop Security 2010.lnk (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Start Menu\Programs\Desktop Security 2010\Desktop Security 2010.lnk (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Start Menu\Programs\Desktop Security 2010\Help Desktop Security 2010.lnk (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Start Menu\Programs\Desktop Security 2010\How to Activate Desktop Security 2010.lnk (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\daily.cvd (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\mfc71.dll (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\MFC71ENU.DLL (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\msvcp71.dll (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\msvcr71.dll (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\pthreadVC2.dll (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\securityhelper.exe (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Desktop Security 2010\taskmgr.dll (Rogue.DesktopSecurity2010) -> Delete on reboot.

C:\Documents and Settings\KF Creative\Start Menu\Programs\Desktop Security 2010.LNK (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Application Data\Microsoft\Internet Explorer\Quick Launch\Desktop Security 2010.LNK (Rogue.DesktopSecurity2010) -> Quarantined and deleted successfully.

C:\Documents and Settings\KF Creative\Local Settings\Temp\wrfwe_di.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

[rob.]

I ran this last full scan, above, in safe mode as an admin.

[Firefox]

Hello rob., and welcome to the forums here at Malwarebytes.org

Please read the following so that you can begin the cleaning process:

We don't work on Malware removal in the general forums.

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

Please note that it may take 48 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 48 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.

If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

If you are a corporate customer please send an email to corporate-support@malwarebytes.org. (NOTE: An order number is required for corporate support.)

Also, when replying, please use the "ADD REPLY" button or erase what the person you are replying to said, as this makes the forum easier to read.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Thank you