XxX.XxX UuU.UuU

[xryckaxx]

Hello, my friend is having a problem . mbam quick scan finds these. we press delete all of them. it says delete complete all files deleted. but when you do the scan again the files are still there.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5688

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

2011.02.06 15:40:03

mbam-log-2011-02-06 (15-39-58).txt

Scan type: Quick scan

Objects scanned: 35231

Time elapsed: 1 minute(s), 40 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} (Backdoor.Bifrose) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} (Backdoor.Bifrose) -> No action taken.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKLM (Backdoor.Bifrose) -> Value: HKLM -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies (Backdoor.Bifrose) -> Value: Policies -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU (Backdoor.Bifrose) -> Value: HKCU -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies (Backdoor.Bifrose) -> Value: Policies -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\install\winupdate.exe (Backdoor.Bifrose) -> No action taken.

In %temp% there is files xxx.xxx uuu.uuu if you delete them and then delete from recycle bin they renew again.

we got to c:\install\winupdate.exe . but this folder is hidden. we enabled to see the hidden folders but its still hiden.

please respond.

[Fatdcuk]

Hi xryckaxx,

The computer needs to rebooted/restarted when the application requests inorder for MBAM to complete the removal of those files

[xryckaxx]

Thanks. Failed so hard. xD