Browser Settings Infected

[Aesier]

Hi, I am new to the forum and if I post anything that should be elsewhere please let me know and I will try to get it posted to the correct locations.

I am a computer technician and I have a customer that has an older computer that has gotten very slow. I started running some virus scans on it before optimizing it to make sure it is clean (customer doesn't want to refurbish the system). I ran malwarebytes on it and it found 6 infections originally. 2 of the infections were executable files which were removed without a problem. The other 4 were registry entries that malwarebytes cannot remove, nor can I remove them manually by going into the registry. I have seen these files on other forum posts, but I have not found a definite answer as to how I am supposed to remove them. Any help would be appreciated.

- - - - - MWB Log - - - - - - -

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6013

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 7.0.5730.11

03/10/2011 16:59:45

mbam-log-2011-03-10 (16-59-45).txt

Scan type: Full scan (C:\|)

Objects scanned: 194829

Time elapsed: 18 minute(s), 5 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Value: bf -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Value: bk -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Value: iu -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Value: mu -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\webselfstorage\gate.exe (Spyware.Passwords) -> Not selected for removal.

c:\webselfstorage\gate\gatesystem.exe (Spyware.Passwords) -> Not selected for removal.

- - - - - - END Log - - - - - - -

NOTE: Even though it says "Delete on reboot." the files are never deleted. This log is from my 3rd scan. When I go into the registry to delete them it says "Unable to delete all specified values." which makes it understandable why MWB isn't removing them. Is there a way to do this or is a refurb my only option?

[prairie dog]

Hello, and welcome to Malwarebytes.org

We don't work on Malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org