Infected with Virtumonde and others

Discussion in 'Malware Help (A Specialist Will Reply)' started by csebasti, Jan 9, 2009.

  1. csebasti

    csebasti Private E-2

    A couple days ago my computer started acting strange, so I ran a scan and found virtumonde as well as some others on it. I have read through and ran everything in the "Read & run me first" thread. I'm not sure if everything has been removed, as each new scan seemed to be finding and removing the same things.

    Also, I'd like to note that with ComboFix, when instructed to disable all antivirus and firewall software, I did. But ComboFix told me that McAfee was still running. As far as I know, I didn't even have McAfee installed (I use Symantec/Norton), and even did a search on the computer and came up with two McAfee folders that had nothing in them that was running. I ran ComboFix anyway... Not sure if this is a problem.

    Here are the log files. I'd appreciate some feedback on waht to do next, if anything. Thanks.

    Chris
     

    Attached Files:

    csebasti, Jan 9, 2009
    #1
  2. csebasti

    csebasti Private E-2

    And the 4th log file...
     

    Attached Files:

    csebasti, Jan 9, 2009
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks like the scans took care of most of it....let's do this:

    If you haven't already, please disable the Guest account in User accounts.

    Please use add/remove programs to uninstall:
    Viewpoint Media Player

    Please disable all anti-virus and anti-spyware programs while we do the following ( be sure to re-enable when we are finished):

    Run C:\MGtools\analyse.exe by double clicking on it. (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now use windows explorer to find and delete:
    c:\windows\Tasks\dfgxfgwl.job

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip and be sure to tell me how things are running. :)
     
    TimW, Jan 12, 2009
    #3
  4. csebasti

    csebasti Private E-2

    Tim,

    Thanks for the reply. I'll run through your list on my computer tonight. I did have a question pertaining to turning off all antivirus software when running MGTools. When I ran ComboFix initially, it told me that it found McAfee Antivirus running, but I have never used that on this computer, and can't find a way to turn it off if it really is running. I went ahead and ran ComboFix anyway. Is this a problem? MGTools didn't give me a warning when I ran it, so maybe its just a false warning?

    Also, my Symantec Antivirus Autoprotect was dissabled by the virus/malware that I had, nad I can't turn it back on. I ahve tried several times, and it tells me it'll take effect the next time I run the program. After restarting I still get messages saying its off. Any ideas?

    I'll post new logs tonight after running through your directions. Thanks again!

    Chris
     
    csebasti, Jan 12, 2009
    #4
  5. csebasti

    csebasti Private E-2

    Tim,

    I have run through your list. Here are my results:

    The Guest user account was already disabled.

    I removed Viewpoint Media Player as requested.

    I disabled anti-spyware programs. I could not find a way to completely close Symantec AV (its still in the tray), but autoprotect is disabled, and I have not been able to re enable it since becoming infected with Virtumonde.

    I ran C:\MGtools\analyse.exe and fixed/removed the 3 BHO entries, but could not find the AppInit_DLLs line. I looked through it 3 times, it wasn't there.

    I created the fixME.reg file and ran it. I received an error message saying "Cannot import C:\Documents and Settings\Chris\Desktop\fixME.reg: Error accessing the registry."

    I deleted c:\windows\Tasks\dfgxfgwl.job. Any idea what that was? I noticed it a couple days ago and couldn't figure out what it was. Only that it was scheduled to run every hour.

    New logs attached.

    The computer has been running better since I originally ran through the "Run & read me first" info. Like I said though, I cannot enable the Symantec Autoprotect. Also, I've tried the Live Update a couple times to get the latest virus definitions for Symantec, and it seems to work, but never shows that it has been updated. It still shows that I'm using version 2009-01-02 rev. 6.

    Thanks again for the help. Its greatly appreciated!

    Chris
     

    Attached Files:

    csebasti, Jan 13, 2009
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Well. I have no idea what happened, but your logs are clean.......

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, Jan 14, 2009
    #6
  7. csebasti

    csebasti Private E-2

    Thanks for the help, Tim. I really appreciate it.

    Chris
     
    csebasti, Jan 16, 2009
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome...safe surfing. :)
     
    TimW, Jan 16, 2009
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds