Quarantaine of eset NOD32

[Mar57]

Hi guys,

Here I am once again..... :rolleyes:

There are some threads in the quarantaine of eset. The trusted ones I did restore and exclude from scanning. However there are two left I want to get rid of. If I use the option Delete from Quarantaine will it delete the file from my pc or is it only deleted from quarantaine after that?

[DKT27]

If the files are left only on your quarantine then it will delete it forever, from PC and quarantine.

[Mar57]

Not sure if they are only left in quarantaine, another scan has to be performed to be sure of that. Anyway I know now deleting means, gone of the pc.

Thanks so far!! :D

[DKT27]

Delete can also mean to recycle bin. :D

[shought]

Moved your thread to the proper forum ;)

If the file is in quarantine it is 'theoretically' already removed from your PC, it is stored by ESET and can't be opened in any way, only ESET can restore it.

So if you remove the quarantined file then there will be left not trace of the file.

[Mar57]

Well, I have to wait for the results of an other scan if they will re-appear some way. I assume that the recycle bin will be scanned as well then?

[shought]

Any file on your computer will be scanned, except for the files that are encrypted with a password or in the boot sector(unsure), of course :)

Your recycle bin will most likely not contain any viruses, unless you've manually deleted them? :P

[Mar57]

Okay :dance2:

I 've got more things in quarentaine, caused by the cracks and keygens I've used for the Adobe applications......

Still don't know if I can keep them in "bitlord" in case some crash will harm the applications so I can restore things. Or is it better to get rid of keygens after the apps are installed?

I exclude the Bitlord file every time from scanning now....

[Mar57]

So, theoretically, I can remove everything that is in quarantaine now? The applications are still working fine......... Still not sure about the disablers yet.......

An overview of some files that are in quarantaine:

C:\Documents and Settings\Mar\Local Settings\Temp\svchost.exe ---- Win32/shutdowner.NAL.trojan

C:\System Volume Information\restore{34169A92-42FE-BD65-FA51F056D750}RP235A0058679.exe ----- multiple threads

C:\System Volume Information\restore{34169A92-42FE-BD65-FA51F056D750}RP229\A0056134.vbs ------- VBS/Disabler.NAB.trojan

C:\WINDOWS\system32\tibwgWy.vbs ------ - VBS/Disabler.NAB.trojan

C:\WINDOWS\system32\kcThl.vbs ------- VBS/Disabler.NAB.trojan

C:\WINDOWS\system32\fURz0jF6UjxT7yG.vbs ------- VBS/Disabler.NAB.trojan

C:\WINDOWS\system32\bLI4o.vbs ------- VBS/Disabler.NAB.trojan

C:\WINDOWS\system32\7am0Ew.vbs ------- VBS/(blokje)

[karachidude]

zip the keygens,password protect them.Use sandbox to run them.

If cracks and serials are available,avoid keygens.

yes the apps will still work...most keygens trigger false positives by the way.

[Mar57]

Yes, I was aware of that..... :) All files are kept zipped in Bitlord. However wasn't sure if the things I posted (as being in quarantaine) and are of the disablers can be removed without harming the applications....

Btw, does that count for all apllications? Using cracks instead of serials?

[Bizarre™]

@Mar57:

D*mn, you got a lot of nasties in your system32 folder.

I think you should use HijackThis: Link

[Mar57]

I've got already HJT......

Should I be more worried now than I was before asking here? :wub: And can I post the HJT overhere??

[shought]

What applications?

To me these files all seem to be connect to a virus or trojan, random filenames for the .vbs files, svchost.exe(commonly used) and A...number....exe(system restore way of archiving files or something, most likely copies of the virus).

You can go ahead and remove them, if they're in quarantine already any application that might want to use the file won't be able to.

I do recommend using Spybot S&D, Trojan Remover AND Trend Micro HouseCall(online) to scan your computer and make totally sure it is clean(scan, if something found remove it, scan again, if something found remove it, scan again, don't stop until you get a clean scan from them all). Suggested order: Trojan Remover, Spybot S&D and then HouseCall, over and over again, if you have to.

@mar

yeah, you can post it.

@Bizarre

Not a lot, they're probably all the same virus ;)

[Mar57]

I've got Spyware Doctor.............

Okay, here is my HJT file....

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:10:35, on 26-9-2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\system32\RunDll32.exe

C:\WINDOWS\Dit.exe

C:\WINDOWS\system32\PRISMSTA.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\DitExp.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Adobe\Adobe Fireworks CS4\Fireworks.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\PhotoFiltre\PhotoFiltre.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Marian\Bureaublad\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.nl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: PHPNukeDU Toolbar - {46735dee-f862-49d1-876d-6382794dc625} - C:\Program Files\PHPNukeDU\tbPHPN.dll

R3 - URLSearchHook: muziekopjepc.nl Toolbar - {c5423ac5-07d3-438a-a1d2-5a15fe52e72b} - C:\Program Files\muziekopjepc.nl\tbmuzi.dll

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

O2 - BHO: PHPNukeDU Toolbar - {46735dee-f862-49d1-876d-6382794dc625} - C:\Program Files\PHPNukeDU\tbPHPN.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: muziekopjepc.nl Toolbar - {c5423ac5-07d3-438a-a1d2-5a15fe52e72b} - C:\Program Files\muziekopjepc.nl\tbmuzi.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: PHPNukeDU Toolbar - {46735dee-f862-49d1-876d-6382794dc625} - C:\Program Files\PHPNukeDU\tbPHPN.dll

O3 - Toolbar: muziekopjepc.nl Toolbar - {c5423ac5-07d3-438a-a1d2-5a15fe52e72b} - C:\Program Files\muziekopjepc.nl\tbmuzi.dll

O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [Cmaudio] "RunDll32" cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [Dit] "Dit.exe"

O4 - HKLM\..\Run: [PRISMSTA.EXE] "PRISMSTA.EXE" START

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [KCeasy] C:\Program Files\KCeasy\KCeasy.exe /hide

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com

O15 - Trusted IP range: http://192.168.1.254

O15 - ESC Trusted IP range: http://192.168.1.254

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1248100515140

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5710/mcfscan.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe

O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--

End of file - 11278 bytes

:wub: :wub: :wub: :wub:

[shought]

No idea how good that app has become, but I know before I preferred Trojan Remover and Spybot S&D, this killer-combination has yet to fail me :)

[Mar57]

It was recommanded at another forum.... I'll be leaving now. Will see the answer tomorrow morning and perform the SD scan too...

Good night from Holland :rolleyes:

[shought]

Your HJT log looks fine, I'd just recommend using Trojan Remover(evaluation version, because the frontpage is down at the moment), Spybot S&D(free) and Trend Micro HouseCall(online, free).

I'm from the Netherlands myself as well ;) (Although my flag doesn't say so :P)

[HX1]

It looks like most of this is covered here...I would like to refer you to a post I made while back..

http://www.nsaneforums.com/topic/30926-best-malware-scanning-practices/page__hl__recommeded%20scanning__fromsearch__1

Posts #2 and #6.. should cover the removal of the particular infection you have.. which may give you some problems when removing.. if I remember right..

[Mar57]

Hi Shought,

Is it perhaps possible to PM or email with you in Dutch about some things?? Although I can read and write english not everything is clear to me in English....... :wub:

[Mar57]

Still asleep I suppose :rolleyes:

I cleaned up the quarantaine folder in Eset. The applications still working fine so far.....

I performed a scan with MBAM of which the logfile is showed below:

Malwarebytes' Anti-Malware 1.40

Database versie: 2675

Windows 5.1.2600 Service Pack 3

26-9-2009 10:08:14

mbam-log-2009-09-26 (10-08-01).txt

Scan type: Volledige Scan (C:\|D:\|M:\|)

Objecten gescand: 262673

Verstreken tijd: 1 hour(s), 30 minute(s), 53 second(s)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 0

Registerwaarden geïnfecteerd: 0

Registerdata bestanden geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 4

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd: (memory) (No malicious items found)

(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:

(Geen kwaadaardige items gevonden)

Registerwaarden geïnfecteerd:

(Geen kwaadaardige items gevonden) (No malicious items found)

Registerdata bestanden geïnfecteerd:

(Geen kwaadaardige items gevonden) (No malicious items found)

Mappen geïnfecteerd:

(Geen kwaadaardige items gevonden) (No malicious items found)

Bestanden geïnfecteerd: (Files Infected:)

C:\System Volume Information\_restore{34169A92-5B53-42FE-BD65-FA51F056D750}\RP243\A0059417.exe (Trojan.Downloader) -> No action taken.

C:\System Volume Information\_restore{34169A92-5B53-42FE-BD65-FA51F056D750}\RP243\A0059418.EXE (Malware.Packer) -> No action taken.

C:\System Volume Information\_restore{34169A92-5B53-42FE-BD65-FA51F056D750}\RP243\A0059419.exe (Trojan.Downloader) -> No action taken.

C:\System Volume Information\_restore{34169A92-5B53-42FE-BD65-FA51F056D750}\RP243\A0059420.EXE (Malware.Packer) -> No action taken.

In my opinion all files belong to the Adobe applications.... :) I now will start running SD (Spyware Doctor)

[Mar57]

In the first run of SD it only did find 90 tracking cookies which I cleaned up. The second run showed nothing anymore.....

Assuming that everything is okay is it wise to put the 4 files, MBAM found, on the ignorelist of MBAM???

[HX1]

In the first run of SD it only did find 90 tracking cookies which I cleaned up. The second run showed nothing anymore.....

Assuming that everything is okay is it wise to put the 4 files, MBAM found, on the ignorelist of MBAM???

You need to make sure that you go through your settings for SpyBot and make sure your using all file sets and have the program setup properly..use all of the tools it offers...to cleanup and find items/files on your system..There are several areas that should be addressed...and SpyBot has the options to do them..just to make sure..

Also you should run a Disk Cleanup.. and delete all Restore points..This will rid your system of the malware.. those would not be apart of Adobe..

[Mar57]

Okay, so I have to run Spybot S&D.... I already cleaned up with Ccleaner!

Assuming that everything is okay is it wise to put the 4 files, MBAM found, on the ignorelist of MBAM???

Can I put them to the ignorelist?

And Heath, reading around on nsaneforum articles I got the idea you're working with Adobe (I think Illustrator because you downloaded the brushes) too?

I saw 'Adobe CS4 license Manager 2009'........ Can that be used if applications of Adobe already have been installed? If it's possible to use that, can I get a clear explanation of how to do o.a.o.?

[shought]

No, these files should be removed from your system recovery folder, just tell MBAM to quarantine or delete them. It won't hurt any program.

Yes, you may send a PM to me in Dutch ;)

I'd strongly recommend you use Trojan Remover as well, it's really good.