Help! Infected with Virtumundo!!

seagrass · Jul 12, 2006

I've downloaded both Vundofix and Virtumundobegone...neither seems to work, and I am still getting pop-ups. Ran them both in normal and safe modes as well. Here is my Hijackthis log:

DavidGP · Jul 12, 2006

Hi and Welcome

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

Click to expand...

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

Bitdefender

Panda Scan

HijackThis

seagrass · Jul 12, 2006

OK, did everything again and attached logs...however, it says my vscan log is too big to attach, so what should I do? looks like I have more problems than I thought, and this computer is not even 2 weeks old yet. ARGHHHH.

Shadow_Puter_Dude · Jul 12, 2006

Please zip the log and attach the resulting file.

seagrass · Jul 14, 2006

OK, here are fresh Panda and Hijack this logs, in addition to the previously attached Bitdefender log

Shadow_Puter_Dude · Jul 17, 2006

You are running 2 Resident Antvirus applications. You only need 1. Having more that 1 resident Antivirus application on your computer will cause problems. They will interfer with each of and create conflicts, causing system performance to suffer. Pick one uninstall the other.

You were not asked to install BitDefender8 Free Edition. Our directions called for the running of the BitDefender Online Scanner. Uninstall BitDefender8.

HijackThis is in the location specified by our Read ME. Right-click on the underlined text and Save Link as to your Desktop. Move_HijackThis.vbs

Double-click Move_HijackThis.vbs on your Desktop. This script will move HijackThis to the proper location. DO THIS before you continue with my instructions.

Windows Messeger is running in the background on this computer, and represents a security risk. Disable Windows Messenger by running Shoot The Messenger. If you are using this as your IM client then replace it with MSN Messenger.

<< The installed version of Java on this compter is out-dated. Install version 1.5.0_07 available from http://www.java.com/en/download/manual.jsp. Uninstall all older versions of Java on your computer, before installing the latest version of Java. >>

Download
- Pocket Killbox
- ExplorerXP

In HJT Choose Open the Misc Tools Section choose Process Manager, Highlight:

C:\WINDOWS\system32\a8c9529a.exe
C:\WINDOWS\SKS~1\javaw.exe
Click to expand...

Choose Kill Process

Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O4 - HKLM\..\Run: [a8c9529a.exe] C:\WINDOWS\system32\a8c9529a.exe
O4 - HKCU\..\Run: [a8c9529a.exe] C:\Documents and Settings\Chris G\Local Settings\Application Data\a8c9529a.exe
O4 - HKCU\..\Run: [Tair] "C:\WINDOWS\SKS~1\javaw.exe" -vt ndrv
O20 - AppInit_DLLs: C:\WINDOWS\system32\javaw.dll
O20 - Winlogon Notify: wingsa32 - C:\WINDOWS\SYSTEM32\wingsa32.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - (no file)
Click to expand...

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\Documents and Settings\Administrator\Local Settings\Temp\nsd40.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\nso3A.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\nsr3C.tmp
C:\Documents and Settings\Chris G\Local Settings\Application Data\a8c9529a.exe
C:\Documents and Settings\Chris G\Local Settings\Temp\nsd2A.tmp
C:\Documents and Settings\Chris G\Local Settings\Temp\nsl47.tmp
C:\Program Files\Common Files\Y1123OA.exe
C:\VundoFix Backups\xxyywvw.dl
C:\WINDOWS\g2074187.dll
C:\WINDOWS\g268687.dll
C:\WINDOWS\g272484.dll
C:\WINDOWS\Downloaded Program Files\gdnUS2339.exe
C:\WINDOWS\Downloaded Program Files\YazzleActiveX.ini
C:\WINDOWS\Downloaded Program Files\YazzleActiveX.ocx
C:\WINDOWS\SKS~1\javaw.exe
C:\WINDOWS\system32\a8c9529a.exe
C:\WINDOWS\system32\components\flx0.dll
C:\WINDOWS\system32\components\flx2.dll
C:\WINDOWS\system32\components\flx3.dll
C:\WINDOWS\system32\components\flx4.dll
C:\WINDOWS\system32\components\flx5.dll
C:\WINDOWS\system32\components\flx6.dll
C:\WINDOWS\system32\components\flx7.dll
C:\WINDOWS\system32\components\flx8.dll
C:\WINDOWS\system32\compstuic.dll
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\ismon.exe
C:\WINDOWS\system32\isnotify.exe
C:\WINDOWS\system32\javaw.dll
C:\WINDOWS\system32\oins.exe
C:\WINDOWS\system32\ot.ico
C:\WINDOWS\system32\pmnqguh.dll
C:\WINDOWS\system32\wingsa32.dll
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

C:\Documents and Settings\Administrator\Local Settings\Temp\nsd40.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\nso3A.tmp <<=== Delete the File
C:\Documents and Settings\Administrator\Local Settings\Temp\nsr3C.tmp <<=== Delete the File
C:\Documents and Settings\Chris G\Local Settings\Application Data\a8c9529a.exe <<=== Delete the File
C:\Documents and Settings\Chris G\Local Settings\Temp\nsd2A.tmp <<=== Delete the File
C:\Documents and Settings\Chris G\Local Settings\Temp\nsl47.tmp <<=== Delete the File
C:\Program Files\Common Files\Y1123OA.exe <<=== Delete the File
C:\VundoFix Backups\xxyywvw.dl <<=== Delete the File
C:\WINDOWS\g2074187.dll <<=== Delete the File
C:\WINDOWS\g268687.dll <<=== Delete the File
C:\WINDOWS\g272484.dll <<=== Delete the File
C:\WINDOWS\Downloaded Program Files\gdnUS2339.exe <<=== Delete the File
C:\WINDOWS\Downloaded Program Files\YazzleActiveX.ini <<=== Delete the File
C:\WINDOWS\Downloaded Program Files\YazzleActiveX.ocx <<=== Delete the File
C:\WINDOWS\SKS~1\javaw.exe <<=== Delete the File
C:\WINDOWS\system32\a8c9529a.exe <<=== Delete the File
C:\WINDOWS\system32\components\flx0.dll <<=== Delete the File
C:\WINDOWS\system32\components\flx2.dll <<=== Delete the File
C:\WINDOWS\system32\components\flx3.dll <<=== Delete the File
C:\WINDOWS\system32\components\flx4.dll <<=== Delete the File
C:\WINDOWS\system32\components\flx5.dll <<=== Delete the File
C:\WINDOWS\system32\components\flx6.dll <<=== Delete the File
C:\WINDOWS\system32\components\flx7.dll <<=== Delete the File
C:\WINDOWS\system32\components\flx8.dll <<=== Delete the File
C:\WINDOWS\system32\compstuic.dll <<=== Delete the File
C:\WINDOWS\system32\ishost.exe <<=== Delete the File
C:\WINDOWS\system32\ismon.exe <<=== Delete the File
C:\WINDOWS\system32\isnotify.exe <<=== Delete the File
C:\WINDOWS\system32\javaw.dll <<=== Delete the File
C:\WINDOWS\system32\oins.exe <<=== Delete the File
C:\WINDOWS\system32\ot.ico <<=== Delete the File
C:\WINDOWS\system32\pmnqguh.dll <<=== Delete the File
C:\WINDOWS\system32\wingsa32.dll <<=== Delete the File
Click to expand...

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

Log in or Sign up

Help! Infected with Virtumundo!!

seagrass Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

seagrass Private E-2

Attached Files:

hijackthis.log

Activescan.txt

Shadow_Puter_Dude MG Authorized Malware Fighter

seagrass Private E-2

Attached Files:

hijackthis.log

vscan.zip

Shadow_Puter_Dude MG Authorized Malware Fighter