[ROOTKIT INFECTION] PUP.BitMiner: kwrd.dll

[jholland1964]

Absolutely, be sure to update MBA-M of course and then do the full system scan in normal mode, have it remove all, reboot and post back here with the log. Wonder how she "removed" it? Sounds like she just went in and deleted the files, which of course removes the visible traces but not the program.

[KamikazeKarrot]

Don't know really. She's usually pretty good with computers.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 911122605

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

12/26/2011 8:26:41 PM
mbam-log-2011-12-26 (20-26-41).txt

Scan type: Full scan (C:\|)
Objects scanned: 337760
Time elapsed: 37 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\assembly\temp\kwrd.dll (PUP.BitMiner) -> Quarantined and deleted successfully.

Restarting now.

EDIT: Restart worked. Going to run ESET now.

[jholland1964]

Log is usually always located here

C:\Program Files\EsetOnlineScanner\log.txt.

I haven't seen one that is located where you found it.