Need help with removal... Mostly Virtumundo, maybe more

Welcome to Major Geeks!

You need to attach all the log that are requested in the READ ME. The below is what was requested:

• CounterSpy - only for Windows XP, 2K, & NT users
• AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
• Bitdefender - from step 6
• Panda Scan - from step 6
• runkeys.txt - the log from GetRunKey.bat
• newfiles.txt - the log from ShowNew.bat
• HijackThis

 

You need to run AVG Antispyware again and this time fix what it finds. You ignored everything. There is no sense in running the scanners unless you fix what they find. Attach a new log after this new run.


Uninstall the below software:
Java 2 Runtime Environment, SE v1.4.2_03 <-- should have been uninstall in step 6 of the READ ME
Viewpoint Media Player <-- should have been uninstalled in step 0 of the READ ME

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment


Next run this Virtumonde aka Trojan Vundo Removal and do not attach the requested log right away. Run it multiple times until it comes up clean and then attach the final log.


Now attach the below new logs so we can continue with your remaining cleanup.

1. AVG Antispyware
2. VundoFix
3. GetRunKey
4. ShowNew
5. HJT

 

Yes it did! Please attach it. It is exactly where the procedure said it would be. C:\VundoFix.txt

You still did not take any action with AVG Antispyware. Why aren't you fixing things it finds? Run it again and Quarantine or Delete what it finds. Attach a new log.

 

Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {045F490A-289C-41E7-BB8F-1AC8B42ACE6C} - C:\WINDOWS\system32\vturq.dll (file missing)
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O2 - BHO: (no name) - {0CD75D10-0BD8-48D1-9F41-76BAAFCEE734} - C:\WINDOWS\system32\hgggefd.dll (file missing)
O2 - BHO: (no name) - {5C7CED02-9C13-4208-A25B-AD135F3D9B59} - C:\WINDOWS\system32\jkhhf.dll (file missing)
O2 - BHO: (no name) - {C39AE226-AC75-4AC4-A3FF-49737984ABA6} - C:\WINDOWS\system32\ssqrp.dll (file missing)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu2000352.exe 61A847B5BBF72810329B385577FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [gf1.0.0.2] C:\WINDOWS\system32\sZMU9hR8.exe
O20 - Winlogon Notify: mljjj - C:\WINDOWS\system32\mljjj.dll (file missing)
O20 - Winlogon Notify: winopn32 - winopn32.dll (file missing)

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it
double click it and allow it to merge with the registry.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. Avenger
2. GetRunKey
3. ShowNew
4. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 8 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

It appears that you did not apply the fixME.reg patch. Try again. Make sure you tell me whether you receive a success message or not afterwards.

If you receive a successs message, attach new logs from GetRunKey and HJT.

 

The file should not open in notepad when you double click on it. If that is happening, your file associations are messed up.

Click Start, Run, and enter regedit and click OK. This will open the Registry Editor.
In the Registry Editor click File and Import. Navigate to the fixME.reg patch you saved on your Desktop and double click on it. Click OK at the prompt to add to the registry. Do you get a success message this way? If so, attach the logs I requested.

 

Uninstall CounterSpy now since we are finished with it.

Make sure you uninstall CounterSpy before doing the below.

• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. Avenger
2. GetRunKey
3. HJT

How are things working now?

 

I still see CounterSpy in your logs! Did you uninstall it before doing the other steps? If you did, then it may not have uninstall properly and we will need to remove the remainder manually.

What popus are you referring too? What do they say?

Run this to make sure they are not from Windows Messenger:Disable/Remove Windows Messenger to remove Windows Messenger.

I don't know what "and internet explorer isnt 100%" is supposed to mean. Be specific and describe your problems.

 

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, and the C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you run Avenger, you can delete all files related to Avenger now.
7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
8. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
9. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

You're welcome but you never answered my question (see msg # 20) about CounterSpy!

 

Just have HJT fix the below line:

O4 - HKLM\..\Run: [SBRegRebootCleaner] C:\Program Files\Sunbelt Software\CounterSpy\SBRC.exe

Also make sure the C:\Program Files\Sunbelt Software has been deleted

 

This is more than likely not a malware problem and it is also not part of your original problem which means you should have created a new thread and you should have run the READ & RUN ME first if you suspected malware. So either do that and start a new thread with your logs if you still suspect malware or uninstall Symantec, REBOOT, and then reinstall it.