system32 ?

[ricosmo4]

is it safe to quarantine the system32 folder ? for example, after doing a scan malwarebyte found the following,...

Malwarebytes' Anti-Malware 1.28

Database version: 1221

Windows 5.1.2600 Service Pack 2

9/29/2008 9:15:40 PM

mbam-log-2008-09-29 (21-15-36).txt

Scan type: Quick Scan

Objects scanned: 49259

Time elapsed: 3 minute(s), 59 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 6

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\ (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\drivers\ (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\tdssinit.dll (Rootkit.Agent) -> No action taken.

C:\WINDOWS\system32\tdssmain.dll (Rootkit.Agent) -> No action taken.

C:\WINDOWS\system32\tdssserf.dll (Rootkit.Agent) -> No action taken.

C:\WINDOWS\system32\drivers\tdssserv.sys (Rootkit.Agent) -> No action taken.

thanks for the help

[JeanInMontana]

It's not quarantinging the System32 folder, the infected items in the folder are being quarantined. Your log shows a rootkit. You need to notify all sensitive data entities immediately that your identity has been compromised; banks, credit cards etc. Consider doing a reformat to completely be sure the rootkit is gone. Otherwise seek assistance in the HJT forum . Read the instructions here http://www.malwarebytes.org/forums/index.php?showtopic=2936 Start your own topic in that forum.