How to Clean Disable Security Center Virus

A couple of days ago on booting my system, I go a blue screen saying that there were some errors and it automatically went on rectifying them. Below are the changes that seem to have occurred according to the log in windows event viewer.

___________________________________________________________
Checking file system on C:
The type of the file system is NTFS.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
The segment number 0x374000000000 in file 0x373e is incorrect.
Correcting a minor error in file 14142.
The segment number 0x374100000000 in file 0x373f is incorrect.
Correcting a minor error in file 14143.
The segment number 0x374200000000 in file 0x3740 is incorrect.
Correcting a minor error in file 14144.
The segment number 0x374300000000 in file 0x3741 is incorrect.
Correcting a minor error in file 14145.
The segment number 0x376c00000000 in file 0x3742 is incorrect.
Correcting a minor error in file 14146.
The segment number 0x376d00000000 in file 0x3743 is incorrect.
Correcting a minor error in file 14147.
The segment number 0x376e00000000 in file 0x3744 is incorrect.
Correcting a minor error in file 14148.
The segment number 0x376f00000000 in file 0x3745 is incorrect.
Correcting a minor error in file 14149.
The segment number 0x379400000000 in file 0x3746 is incorrect.
Correcting a minor error in file 14150.
The segment number 0x379500000000 in file 0x3747 is incorrect.
Correcting a minor error in file 14151.
The attribute list in file 0x3747 indicates the standard information
attribute is outside the base file record segment.
Deleted corrupt attribute list for file 14151.
The segment number 0x379a00000000 in file 0x374c is incorrect.
Correcting a minor error in file 14156.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x171eb for possibly 0x4 clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x171eb for possibly 0x4 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x376c is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14188.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x3cf47a for possibly 0x1c clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x3cf47a for possibly 0x1c clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x376e is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14190.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x3cf84a for possibly 0x1ee clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x3cf84a for possibly 0x1ee clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x376f is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14191.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0xb5f3b for possibly 0x4 clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0xb5f3b for possibly 0x4 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x3794 is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14228.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x2a03 for possibly 0x6 clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x2a03 for possibly 0x6 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x379a is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14234.
Cleaning up instance tags for file 0xb43c.
Deleting orphan file record segment 14157.
The object id in file 0x3745 already existed in the object
id index in file 0x19.
c8 3e 13 6c b0 1d de 11 b7 64 00 19 d1 7b ff aa .>.l.....d...{..
05 2d 00 00 bc e5 06 00 cf 98 05 01 a4 e2 06 00 .-..............
Deleting duplicate object id from file record segment 14149.
The file reference 0x100000000374c of index entry ATHPRXY.DLL of index $I30
with parent 0x1d is not the same as 0xd6400000000374c.
Deleting index entry ATHPRXY.DLL in index $I30 of file 29.
The file reference 0x12fa00000000373f of index entry _REGISTRY_USER_USRCLASS_S-1-5-20 of index $I30
with parent 0x361e is not the same as 0x100000000373f.
Deleting index entry _REGISTRY_USER_USRCLASS_S-1-5-20 in index $I30 of file 13854.
The file reference 0x12fa00000000373f of index entry _RF17F~1 of index $I30
with parent 0x361e is not the same as 0x100000000373f.
Deleting index entry _RF17F~1 in index $I30 of file 13854.
Index entry MAPPING.VER of index $I30 in file 0x371a points to unused file 0x374d.
Deleting index entry MAPPING.VER in index $I30 of file 14106.
Unable to locate the file name attribute of index entry 1033
of index $I30 with parent 0x371b in file 0x3740.
Deleting index entry 1033 in index $I30 of file 14107.
The file reference 0x1000000003742 of index entry mdm.exe of index $I30
with parent 0x371b is not the same as 0x113a000000003742.
Deleting index entry mdm.exe in index $I30 of file 14107.
The file reference 0x1000000003746 of index entry msdbg2.dll of index $I30
with parent 0x371b is not the same as 0x87f000000003746.
Deleting index entry msdbg2.dll in index $I30 of file 14107.
The file reference 0x1000000003743 of index entry pdm.dll of index $I30
with parent 0x371b is not the same as 0xea000000003743.
Deleting index entry pdm.dll in index $I30 of file 14107.
The parent 0x1000000003740 of index entry mdmui.dll of index $I30
in file 0x3741 is incorrect. The expected parent is 0x100000000373e.
Deleting index entry mdmui.dll in index $I30 of file 14142.
The parent 0xea00000000376d of index entry settings.sol of index $I30
in file 0x3775 is incorrect. The expected parent is 0xea000000003743.
Deleting index entry settings.sol in index $I30 of file 14147.
The file reference 0x2d200000000373e of index entry Dc5101.bmp of index $I30
with parent 0x5bfe is not the same as 0x100000000373e.
Deleting index entry Dc5101.bmp in index $I30 of file 23550.
The file reference 0x8db000000003747 of index entry queue.xml of index $I30
with parent 0x9d79 is not the same as 0x871000000003747.
Deleting index entry queue.xml in index $I30 of file 40313.
The file reference 0xd71000000003744 of index entry HT8579~1.LOC of index $I30
with parent 0x9f7a is not the same as 0x72000000003744.
Deleting index entry HT8579~1.LOC in index $I30 of file 40826.
The file reference 0xd71000000003744 of index entry http_www.ndtv.com_0.localstorage-journal of index $I30
with parent 0x9f7a is not the same as 0x72000000003744.
Deleting index entry http_www.ndtv.com_0.localstorage-journal in index $I30 of file 40826.
The file reference 0xe9000000003745 of index entry RT88B3~1.YML of index $I30
with parent 0x11157 is not the same as 0x7f000000003745.
Deleting index entry RT88B3~1.YML in index $I30 of file 69975.
The file reference 0xe9000000003745 of index entry rt_20090628-090315.yml of index $I30
with parent 0x11157 is not the same as 0x7f000000003745.
Deleting index entry rt_20090628-090315.yml in index $I30 of file 69975.
Cleaning up minor inconsistencies on the drive.
CHKDSK is recovering lost files.
Recovering orphaned file 1033 (14142) into directory file 14107.
Recovering orphaned file mdm.exe (14144) into directory file 14107.
Recovering orphaned file pdm.dll (14145) into directory file 14107.
Cleaning up 688 unused index entries from index $SII of file 0x9.
Cleaning up 688 unused index entries from index $SDH of file 0x9.
Cleaning up 688 unused security descriptors.
Inserting data attribute into file 14151.
Inserting data attribute into file 14188.
Inserting data attribute into file 14190.
Inserting data attribute into file 14191.
Inserting data attribute into file 14228.
Inserting data attribute into file 14234.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

61440560 KB total disk space.
13410732 KB in 49495 files.
25200 KB in 6469 indexes.
0 KB in bad sectors.
148716 KB in use by the system.
65536 KB occupied by the log file.
47855912 KB available on disk.

4096 bytes in each allocation unit.
15360140 total allocation units on disk.
11963978 allocation units available on disk.

Internal Info:
a0 39 01 00 aa da 00 00 2c 36 01 00 00 00 00 00 .9......,6......
e5 00 00 00 02 00 00 00 da 03 00 00 00 00 00 00 ................
f4 69 b3 02 00 00 00 00 44 e0 b5 2a 00 00 00 00 .i......D..*....
b8 40 dc 07 00 00 00 00 00 00 00 00 00 00 00 00 .@..............
00 00 00 00 00 00 00 00 8e b4 6b 3d 00 00 00 00 ..........k=....
10 1e 2f 6b 00 00 00 00 80 36 07 00 57 c1 00 00 ../k.....6..W...
00 00 00 00 00 b0 86 32 03 00 00 00 45 19 00 00 .......2....E...

Windows has finished checking your disk.
Please wait while your computer restarts.
_______________________________________________________________

After the changes were finished Windows XP seemed to start normally, but NOD32 4.0 did not start automatically. And every time I tried to open it manually I got the message that egui.exe is invalid.

I did a MBAM (Malware Bytes) scan and it returned three potential malwares

Vendor: PUM.Disabled.SecurityCenterDisabled
Category: Registry Data
Item: HKLM\Software\Microsoft\Security Center|UpdatesDisableNotify
Item: HKLM\Software\Microsoft\Security Center|FirewallDisableNotify
Item: HKLM\Software\Microsoft\Security Center|AntiVirusDisableNotify

I removed all three of them using MBAM but was still unable to open NOD32.

I used the NOD32 setup file to repair NOD32 and after restarting the system, NOD32 was working again and I did a complete scan but it did not detect anything.

Now NOD32 is working fine and updating automatically. The Firewall is on and all applications seem to be working normally.

As far as Windows Updates are concerned, I am getting a Red Balloon in the System Tray that my Automatic Updates are OFF.

I have always kept Windows Automatic Updates OFF and never got any Red Balloon in the System Tray nor did MBAM ever show it as a potential threat. But now if I manually keep Windows Automatic Updates OFF MBAM is showing it as a threat (Item: HKLM\Software\Microsoft\Security Center|UpdatesDisableNotify). If I clean it using MBAM then a red baloon is coming in the system tray but MBAM isnt showing any threat.

If I remove the Red Baloon then again MBAM is showing the threat. I tried using SuperAntiSpyware and it also showing the exact same thing in the same way.

Can anyone please explain to me what kind of virus threat I am dealing with and how to clean it?

 

The initial problem seems to have been caused by a disk failure. As for MBAM, it detects a registry setting that disables notifications about Windows updates which is what malware often does and thus certain programs may alert about it.

 

Thank you for the reply.

Do you mean I dont have a virus and that my Hard Disk maybe about to Fail? If yes how do I know the status of my Hard Disk quality?