Virtumonde Infection: Unsure if Clean

Discussion in 'Malware Help (A Specialist Will Reply)' started by two20joe, Mar 14, 2009.

  1. two20joe

    two20joe Private E-2

    Hello -

    I recently discovered Virtumonde on my computer and followed the steps in the "Read & Run Me First" section. Things generally seem better, but there are still a few oddities that make me wonder if there are any further steps I need to take. Attached are three of the necessary logs, and below are a few notes/questions I made during the removal process that may or may not be relevant. However, my ComboFix log is over the 250kb posting limit (it's over 500kb). What is the preferred way of sharing it?

    Thanks for your help!
    -two20joe-

    1) During the Uninstall Malware via Add/Remove, I was unable to remove the My Way Search Assistant, getting the messeage that "Error loading C:\PROGRA~1\MyWaySA\SrchAsDe\1.bin\descras.dll. The specified module could not be found."

    2)Every time I restarted the computer during the process, I got a message bubble in the toolbar informing me that files are ready to be burned to a CD. This message continues to pop up on restart.

    3) After completing the last step, McAffee informed me of a couple of registry changes. Is this attributable to ComboFix, or is it a sign that something is still wrong?
     

    Attached Files:

    two20joe, Mar 14, 2009
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You can just zip the combo log and attach it that way. It looks like the scans did their job, but the Combo log may show remnants of the Myway garbage.
     
    TimW, Mar 16, 2009
    #2
  3. two20joe

    two20joe Private E-2

    Thanks for checking this out. ComboFix log is attached as a .zip
     

    Attached Files:

    two20joe, Mar 16, 2009
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    That did it.....your logs are clean. :)

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, Mar 18, 2009
    #4
  5. two20joe

    two20joe Private E-2

    Thanks so much for all of your help. I only have two remaining questions:

    Does one of the programs run during the "READ AND RUN ME FIRST" steps make registry changes that would explain the warnings I got from McAfee to that effect when I completed that process?

    I seem to have a number of quarantined files in my McAfee list (I couldn't find them initially) that are identified as being linked to the Virtumonde issue. Is it safe to ask McAfee to remove them?
     
    two20joe, Mar 18, 2009
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes there are changes made while running MGtools; however they are only things to correct potential problems and to fix bugs within ComboFix. As far as SAS, MBAM, and ComboFix are concerned yes they would be making changes to the registry too. So does McAfee when it runs. ;)

    Yes.
     
    chaslang, Mar 21, 2009
    #6
  7. two20joe

    two20joe Private E-2

    Great - thanks so much to both of you for all of your help on this!
     
    two20joe, Mar 22, 2009
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Mar 24, 2009
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds