malaware found including backdoor please help

Uninstall the below old versions of software:
IBM 32-bit Runtime Environment for Java 2, v1.4.1
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Mozilla Firefox (1.5.0.11)

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Then install the current version of FireFox from: Mozilla Firefox



Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZS

After clicking Fix, exit HJT.

Now reboot in normal mode

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Manually delete the infected email (with a crack file) that BitDefender found and could not delete.


Make sure you tell me how things are working now!

If you are having any problems, please be sure to describe them.

 

No you did not! This time you got a different registry key related to MyWebSearch. It now found this:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}

The keys in your first log were different.

You can try using the below patch to see if it will remove that key! Sometime the Ext\Stats keys are annoying to remove and in most cases are not worth the effort since they are not really active problems.


Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

More than likely not malware since you don't show any, but to be on the safe side run the below and attach the log:

Using Sophos Anti-Rootkit