Rogue.Antivirus2010

[naveed93944]

Hi,

I had trouble finding any information on the forums about this problem I am having. None of the posts addressed this exact circumstance.

When I do a quick scan on my computer, 2 Rogue.Antivirus2010 show up.

I removed both items and get the following confirmation:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4503

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

8/29/2010 1:25:37 PM

mbam-log-2010-08-29 (13-25-37).txt

Scan type: Quick scan

Objects scanned: 142398

Time elapsed: 1 minute(s), 23 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Rogue.Antivirus2010) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Rogue.Antivirus2010) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Everything seems cool, but when I run another quick scan, the same two registry malware hits occur.

-- Is this a false positive?

I scanned my computer w/two inferior malware programs:

Windows Security Essentials and even SUPERAntiSpyware.

Both showed my computer was clean.

Im running Windows 7 64-bit.

Thank you for any input, and I apologize if this topic has already been addressed.

[Maurice Naggar]

Howdy,

The rogues often come with hidden re-infection vectors. It is not enough to just run MBAM. And it sometimes takes expert guided help.

Let me suggest, if you're an MBAM customer, you contact the help desk at support@malwarebytes.org

Alternatively, Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Please post there Gmer.txt log

the DDS logs

Don't post your logs here.

P.S. the MBAM findings are not false positive.

[naveed93944]

Maurice,

Thank you for the quick reply. I didnt know that it was a larger problem than just a quick scan could handle. Ill definitely follow your advice, ty again for the help.

[Maurice Naggar]

YW. And, yes, it takes more than just a quick scan.