HI, anyone please help.

below are the log after scanning but after restart pc, the conficker still appear.

Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2

17/09/2009 17:36:28
mbam-log-2009-09-17 (17-36-28).txt

Scan type: Full Scan (C:\|)
Objects scanned: 4812
Time elapsed: 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
S:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 (Trojan.Conficker.H) -> Delete on reboot.

Files Infected:
S:\autorun.inf (Trojan.Conficker.H) -> Delete on reboot.
S:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx (Trojan.Conficker.H) -> Delete on reboot.

Your MBA-M program was not updated prior to the scan. Your database shows as 2775 which is at least 4 days out of date. Current database version is 2818.

BUT you must have a major problem there. Your log clearly shows the following;
Scan type: Full Scan (C:\|)
Objects scanned: 4812
Time elapsed: 9 second(s)

What in the world was scanned? No computer only has 4812 files! And NO MBA-M full scan would only take 9 seconds!

oh....because after full scan, reboot pc, re-scan again. within 9 second, the same virus detected again... that's why i stop the scanning... anyway, i reattach a full scan log.

this time the scanning only detected 1 virus (autorun.inf)
the other 2 virus has been removed by me manually by giving full permission and audit authority on that folder and it manage to delete the RECYCLER folder.
S:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665 (Trojan.Conficker.H)
S:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx (Trojan.Conficker.H)

logs attached
Malwarebytes' Anti-Malware 1.41
Database version: 2814
Windows 5.1.2600 Service Pack 2

18/09/2009 14:39:39
mbam-log-2009-09-18 (14-39-39).txt

Scan type: Full Scan (C:\|)
Objects scanned: 195658
Time elapsed: 1 hour(s), 12 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
S:\autorun.inf (Trojan.Conficker.H) -> Delete on reboot.

Okay... let's make sure this is conficker... a few ways to test if you have the conficker virus is to try to go to legitimate websites like microsoft updates or an anti-virus site. If you can't get in you've been confickered. I have to agree with the above poster no computer in this day and age has only 4812 files... the operating system alone must consist of at least 30,000 files... that's just a guess.

i still able to update Windows Genuine Advantage Validation Tool (KB892130) from Microsoft Update just now.

Notice that, when i scan the C drive, the logs actually detect the Conficker in S: Drive.

S Drive is actually one of my server.

I had run fully scan in S drive (the server itself) with Malware, no virus detected

I hope this isn't a server that hosts data available on the net... I hope you are an expert at removing files without deleting DLLS .... you do not want torn DLLs. Your whole system could fail if you deleted a vital DLL.

i did not delete any DLL.

See if you can upload S:\autorun.inf for analysis here: http://virusscan.jotti.org/en

Please post back with the results.

PP

Here you go ...

Additional info
File size: 95034 bytes
Filetype: Unknown
MD5: 2c29248d7b2ee96a8f3d516dae36c310
SHA1: 0e73e5f50253e821fd87bb845aea0983ccfae404

Scanners
2009-09-17 Worm.Kido.ix 2009-09-18 Worm.Autorun.VHG
2009-09-18 Worm.Win32.Conficker!IK 2009-09-18 Worm.Win32.Conficker
2009-09-17 BV:AutoRun-S 2009-09-18 Net-Worm.Win32.Kido.ix
2009-09-17 Worm/Generic_c.ZS 2009-09-17 Found nothing
2009-09-17 WORM/Kido.IX 2009-09-17 Found nothing
2009-09-18 Worm.Autorun.VHG 2009-09-17 W32/Conficker.C.worm
2009-09-17 Worm.Autorun-1838 2009-09-17 Found nothing
2009-09-18 W32.Net.W.Kido.ix 2009-09-18 Mal/ConfInf-A
2009-09-17 Win32.HLLW.Autoruner.5601 2009-09-17 Found nothing
2009-09-17 JS/AutoRun 2009-09-17 INF.Conficker.F
2009-09-18 Worm:W32/Downaduprun.A

The server is MOST DEFINITELY infected, 7 out of 11 say so. But jotti uses 22 scanners, why are there only 11 showing?