Can't Remove Smitfraud-c and Virtumonde! HELP!

Please begin by clicking Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.

• Scroll down to “Non-plug and Play Drivers” and click the plus icon to open those drivers.
• Then search forTDSSserv.sys
• Let me know if you find this or not.
• If you do find it, right click on it, and select Disable. Do not try to uninstall it.
• Also if TDSSserv.sys is found and you disable it, then reboot.
• After reboot continue on with the below cleaning instructions.

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

• READ & RUN ME FIRST. Malware Removal Guide

• If something does not run, write down the info to explain to us later but keep on going.

• Do not assume that because one step does not work that they all will not.

Notes:

1. If you run into problems trying to run theREAD & RUN ME or any of the scans in normal boot mode. You can run steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools on another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

 

You need to attach the log from running Spybot so I can see what it is reporting. You also need to tell me what MalwareBytes is saying it can not remove.

 

Let's try to do it the easy way first.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
o If it is not on your Desktop, the below will not work.
* Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\WINDOWS\system32\HRXyacdd.ini2
C:\WINDOWS\system32\HRXyacdd.ini

Registry::
[-HKEY_USERS\S-1-5-21-2265280967-2158772066-880934791-1008\Software\Microsoft\instkey]
[-HKEY_CLASSES_ROOT\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\202b9c5b]
[-HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c}]

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Reboot and scan again and tell me if the items still show up.

 

Download and install Registrar Lite

Now run Registrar Lite.

Copy and paste the below into the Address box of registrar lit and hit the Enter key.

HKEY_CLASSES_ROOT\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}

Then click the Security pull down ont the top menu and choose Take Ownership. Click OK in the next window to approve it. Now exit Registrar Lite and continue.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Now reboot and run spybot again and see if it still finds it.

 

Sorry for the bad link.
Download and Install Registrar Lite.

Before doing that, however, uninstall SuperAnti-spyware and then go to the Read and RUn FIrst and install the latest version. Lets see if that will remove it first.

 

Good to know.....If you are not having any other malware issues, then: