Virus question

jhooga

New Member
I had been noticing my computer running slow so i kicked off malwarebytes and it found a few things but what i noticed out of the ordinary was this pup.funwebproducts that came up, when the log came up to remove the infections these two were not checked by default. Here is my malwarebytes log does anybody know what this infection is?
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5794

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2/18/2011 11:42:14 AM
mbam-log-2011-02-18 (11-42-14).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 344011
Time elapsed: 45 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\System32\f3PSSavr.scr (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\f3PSSavr.scr (PUP.FunWebProducts) -> Quarantined and deleted successfully.
 
You must have games installed by funweb. The reason why they are not checked by default is that if some entries are removed then the game won't play correctly without being reinstalled. Usually you will see this on store bought pc's as funweb is usually on preloaded games.
 
Back
Top