GodsOtherHand

Malwarebytes' Anti-Malware 1.40
Database version: 2634
Windows 5.1.2600 Service Pack 3

16.08.2009 14:18:17
mbam-log-2009-08-16 (14-18-17).txt

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 202684
Time elapsed: 38 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Not selected for removal.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Not selected for removal.
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Not selected for removal.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Owner\Desktop\Mai bun\Nod32Patch.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Desktop\New Folder\asx-p7-dmc3se.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\Downloads\Eset.NOD32.Antivirus-3.0.551.Final\Nod32Patch.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Downloads\Eset.NOD32.Antivirus-3.0.551.Final\Mai bun\Nod32Patch.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Program Files\EA Games\Need for Speed Most Wanted\reloaded.exe (Malware.Packer) -> Quarantined and deleted successfully.


Do i need to delete the 3 registry problems also?

TheBruce1

Hello

It would seem from the MBAM log that you have installed a crack version of Nod32.
This is the main reason your computer is infected. Visiting cracksites/warezsites - and other questionable/illegal sites is always a risk.

Even a single click on the site can drop multiple forms of very serious malware, many of which disable your onboard protection, and System Restore.

If you install the cracked software, you are running executable files from these dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer.

Additionally, cracked programs are illegal. Before posting for help, uninstall any such applications.

Referring to the Forum Rules which you should have read at the time of Registering at this forum, TSF does not support illegal activity. As such, be advised that any request for assistance in removing malware may go unanswered, or may be discontinued, if the cracked (illegal) software is still present on the machine

In accordance with the rules we have every right to stop help from this point, but I do believe that education about the effects that P2P/cracks/keygens have in supporting the role of malware, these outlets are the main cause of malware that we see everyday in logs. Any other illegal software that you have, even though they do not appear as trojans themselves, will come from sites that support and promote malware which unknowingly to you, can provide backdoors to your machine and install other malicious items.

Uninstall ALL crack software you have installed then follow instructions below.

===================

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a link at the top of each page.

---------------------------------------------------------------------------------------------

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.