Help, whole computer hijacked by Adware Virtumundo!!

Im coming here because i've tried everything, tried your spyware tutorial, everything, I have done it all.. my computer keeps freezing every 2 seconds, even as I type, then it unfreezes, it's making me go crazy and it sucks!

I dont know how to use Hijackthis, but i have downloaded it and looked on the tutorial and still dont understand...but...

Mcafee recognizes it in C:\WINDOWS\system32\pmkjk.dlll, lavasoft, windows, spybot, no one recognizes this. Mcafee cant remove it either saying it might be "write protected." could you explain to me how to remove it or whichever malicious program is making my computer freeze every two seconds? thanks a bunch in advance, i'll be online all night trying to fix this!

-Blue

Edit by bjgarrick: Unrequested, Inline HJT log removed!

 

Please follow standard cleanup procedures as given below:

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps below:



http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: Downloading, Installing, and Running HijackThis

 

Oh, Im sorry about that.

Here's my logfile after doing everything.

All scans went perfectly fine, However none found the PUP that McAfee found. which is "Adware-Virtumundo" in C:\WINDOWS\system32\pmkjk.dll;
I couldnt manually see this program in system32 in normal or safemode,even with hidden files turned to be shown on.

My HJT is attached, please tell me what i can do to fix this, im very inexperienced at computers but i do sorely not want to lose my computer to malware! thanks for the fast previous reply

-Blue

 

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Please print these instructions out for use in Safe Mode.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning and a list of forums to seek help at.
  it should look like this

• At this point press enter one time.
  
• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\pmkjk.dll​

• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.

• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\kjkmp.*​

• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
• The fix will run then HijackThis will open.
• In HiJackThis, please place a check next to the following items and click FIX CHECKED:

O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\system32\pmkjk.dll
O20 - Winlogon Notify: pmkjk - C:\WINDOWS\system32\pmkjk.dll
​

• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
  
• Once your machine reboots please attach a fresh HJT log from normal mode.

 

I have a question:

When i go in safe mode, i cant log into my account; I have 2 accounts on this computer, one is named G, one is named E; It shows Administrator and E, there's no G, and G is the one that i use. help please

-Blue

edit: i can also not see the Vundofix on the desktop in safemode for the other users, help please

 

Login under Administrator and then follow the removal steps, download the Vundofix to C:\ so you can find it.

 

Okay i downloaded it, i did all the steps up to typing the first file path, but after i type the first file path, Hijackthis pops up, and i dont get to type the next one, should i just ignore hijackthis and type in the second file path?

thx in advance--

-Blue

 

Just follow the tool step by step and you will be fine. If HJT pops up after typing in the filename the first time you need to start over because something isnt right.

 

Thanks! I got a step further, except, when i type it, HJT pops up, which is alright, i click fix the issues, etc. It fixes it and the the HJT area goes blank, but i dont see any blue screen and the PUP, according to mcafee isnt gone, what's wrong?

-thx BLue

EDIT: how long will you still be online?

 

Please when you get back post here, it hasnt been deleted and im worried sick, thanks!! (going to bed now, i dont know if can sleep )

 

Please Help, Virtumundo Hijacked my computer

McAfee is picking up that the PUP Adware Virtumundo is on my computer, it cant remove it, though, saying it is write-protected. Adaware, spybot, etc dont pick it up, so i was told to try VundoFix.exe. I did this, I have hijackthis and went into safemode, I type the name of the file in Vundofix which is C:\WINDOWS\system32\pmkjk.dll, enter then F6 then enter again. the vundofix says file invalid, enter next like the forum guys told you, so i enter C:\WINDOWS\system32\kjkmp.* then F6 then enter. Hijackthis pops up and I have to fix(according to bjgarrick or something) the following:

O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\system32\pmkjk.dll
O20 - Winlogon Notify: pmkjk - C:\WINDOWS\system32\pmkjk.dll


However, after i check FIX on these two, the Hijackthis says that it will delete them but the area in hijackthis goes white, and nothing else is done, when i get out of safemode, and enter normal mode, the PUP isnt gone.

I also didnt get the BLUE SCREEN that i was warned about; can someone tell me what im doing wrong?

I tried asking yesterday on the forums but mid-way the guy who was helping me just...well..disappeared, he logged offline or something. I could use all the help possible please, this is the link which he was talking to me through: http://forums.majorgeeks.com/showthread.php?t=74945.

Attached is my Hijackthis log, and could someone please tell me what to do next?

thanks-blue


PS: ill be on ALL the time, im stressed out trying to fix this asap, thanks.

 

Re: Please Help, Virtumundo Hijacked my computer

BlueXLavaXLamp,

I understand your frustration but you must calm down and relax. We will get this off your machine but you have to slow down and take things one at a time. Now, once more we will attempt the removal with the tool, if you cant do it with the tool we will go to the manual fix.

Before you start this, read over it to get an idea of step by step instructions then procede to follow them. Read very carefully because if you miss one thing the whole fix is no good.


Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Please print these instructions out for use in Safe Mode.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning and a list of forums to seek help at.
  it should look like this

• At this point press enter one time.
  
• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\pmkjk.dll​

• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.

• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\kjkmp.*​

• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
• The fix will run then HijackThis will open.
• In HiJackThis, please place a check next to the following items and click FIX CHECKED:

O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\system32\pmkjk.dll
O20 - Winlogon Notify: pmkjk - C:\WINDOWS\system32\pmkjk.dll​

• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
  
• Once your machine reboots please attach a fresh HJT log from normal mode.

 

Thanks so much for the fast reply. I followed it step by step. This is what happens.

I'm in vundofix and i type enter, as it says

then i type C:\WINDOWS\system32\pmkjk.dll
then i type enter, then F6,

it says file invalid, then i continue,(i dont know if it's supposed to say file invalid)
but then it says type in second filepath as instructed, then i type in(exactly this):

C:\WINDOWS\system32\kjkmp.*

This is where the problems start, HiJackthis opens up, i click scan and dont save log, it scans and shows me everything, and i see the

O2- BHO: msevents Object
and
020-Winlogon notify

Okay, all is good, then i check each, i click fix, it says, please close all browsers, etc then proceed. I proceed, and then everything in the small hijackthis space goes white... Did it fix it? i didnt get any notification; maybe hijackthis file is corrupt and i should d/l another one. But when i go back into normal mode, the PUP is still there.

This was as detailed as i could make it..

THanks for your quick previous response, im trying my best to cool down

PS: when do you log off?

Thanks-

Blue

 

Okay let's start by downloading two tools we will need:

- Process Explorer 9.2

- Pocket KillBox

Extract them to there own folder somewhere that you will be able to locate them later.


Reboot in Safe Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of C:\WINDOWS\system32\pmkjk.dll once and then click the kill button. After you have killed all of the C:\WINDOWS\system32\pmkjk.dll's under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of C:\WINDOWS\system32\pmkjk.dlland kill it.

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\system32\pmkjk.dll
O20 - Winlogon Notify: pmkjk - C:\WINDOWS\system32\pmkjk.dll


Copy the bold text below to notepad. Save it as fixVundo.reg to your desktop.
Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.


C:\WINDOWS\system32\kjkmp.ini
C:\WINDOWS\system32\kjkmp.ini2
C:\WINDOWS\system32\kjkmp.bak
C:\WINDOWS\system32\kjkmp.bak1
C:\WINDOWS\system32\kjkmp.bak2
C:\WINDOWS\system32\kjkmp.tmp
C:\WINDOWS\system32\pmkjk.dll

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot post a new HJT log.

 

Okay, I opened processexplorer, then clicked threads.


There are a lot of things going on "!CreateThread+0x27" and many things like that in the window; I clicked Kill on all of them but each one says "unable to access thread" when i try to delete them

 

You are not following my instructions, you MUST read and follow exactly as I post. Where in my post do you see open process explorer and click threads? You have to open winlogon properties before you click threads. Also DO NOT KILL ANYTHING ELSE!!!!! Only kill the DLL I requested NOTHING ELSE!

 

I clicked on winlogon.exe but it wasnt at the top of the process explorer, im not sure what you mean by that, it was in the "processes" section though, and I do find the threads tab and it's what i typed below, im so sry, im retarded! Where would it be located then?

 

it was also winlogon.exe properties thread that i talked about

 

That's the top part of Process Explorer, locate winlogon.exe, right click and select properties. When it comes up click on the threads tab and locate pmkjk.dll, if found Kill the process, if not found exit and procede on. Do the same with explorer.exe

Do NOT kill any other process!

 

Alright, thanks, I didnt find the pmkjk.dll file in the threads, so i went to the next one, just waiting on it to delete a LOT of temp files, Ill message here when it's done. Also, is this all that i do should the temp files take so long that you have to log off...or is there chance that this wont work?

 

can i skip temp files deletion? it's taking very long, might be repeating, or does it always take this long?

 

Skip that part and run CCleaner (downloaded from the READ ME) then procede.

 

nevermind temp files are gone! okay im going to try it now before CCleaner

 

Okay, help please. I did it all, I clicked Delete on Reboot, everything, and rebooted my computer, but when i went back in normal mode, MCafee still says that it's on my computer.

 

Procede with my instructions, attach a current HJT log.

 

here it is, doesnt look much different to me

 

You have too much protection, my fixes are being blocked so lets do this.

Look in Add/Remove Programs for the following and uninstall when found:

Microsoft AntiSpyware

Viewpoint

After you complete the above, completely disable McAfee and then complete post 15 once more.

 

Done, why did i just remove them and...what do you mean by post 15?

 

im guessing you mean
- Process Explorer 9.2

- Pocket KillBox
that fix?

 

You removed them because one is bad and the other MSAS is blocking my fixes.

What I mean by post 15 is go back to it and complete the fix now that the programs are removed.

 

Okay I did it. However the Hijackthis log looks exactly the same, I must say, this sucks

 

do you recommend me taking the computer to BestBuy or some place to fix it?

 

No, we can fix these issues but we must narrow them down since you have so many. Lets start by running a few programs...

Download this trial version of Ewido Security Suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
• After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report along with a fresh HJT log.

 

ok doing it right now. are you still there?

 

I will be here for a little bit longer.

 

sorry! that scan took forever, i even saw it pass WINDOWS\system32\pmkjk.dll but it didnt recognize it..but anyway here's the log...

im thinking about just reformatting the computer? is this a viable option?

-blue

ps: attached is my ewido log

 

oh and here's the HJT log