Possible Vundo infection?

Felix Felicis · Aug 6, 2008

Now I'm not very computer-savvy, but I've done my best to follow all intructions.
I think I got infected with a virus about a week ago, but only in the last few days are any real problems becoming apparent. I'm running Vista, and the biggest symptom is web pages failing to load. With increasing frequency, neither Firefox nor IE (nor Safari, actually) can find:
Gmail (homepage)
Paypal.com
community.livejournal.com/whatever...

Firefox will give me some standard error message, normally that the site cannot be found. If I try again about 15 minutes later, they're fine. Also, I have a separate Gmail notifier app on my desktop, and when my it also struggles to connect whenever my browser does.
Google informed me that this is a symptom of Vundo or Virtumonde, but a quick scan revealed nothing. I also ran vundofix, but I understand it's pretty useless now.
I've done the recommended scans and loggings (except combofix, which gave me an error message), and I've attached what I have here.
Any help would be hugely appreciated.

chaslang · Aug 7, 2008

Welcome to Major Geeks!

Felix Felicis said: ↑

Google informed me that this is a symptom of Vundo or Virtumonde
Click to expand...

Not true! And you do not have a Vundo infection. I'm not sure if your problem is due to malware or not. Let's finish fixing what I do see in your logs and see what happens afterwards.

What exact error message did you get from ComboFix? Did you try to run it in safe boot mode if normal mode would not work?

First you need to disable Spybot's Teatimer as requested in the READ & RUN ME. See this: How to disable Spybot's TeaTimer

Uninstall the below old versions of software:
Java(TM) SE Runtime Environment 6

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [FixCamera] C:\Windows\FixCamera.exe
O9 - Extra button: eBay.co.uk - Buy It Sell It Love It - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4 (file missing)
O9 - Extra button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redirect-home?tag=Toshibaukbholink-21&site=home (file missing)
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - (no file)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - (no file)

After clicking Fix, exit HJT.

Now download The Avenger by Swandog46, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.

Do not change any check box options!!

Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\Windows\FixCamera.exe
C:\ProgramData\ywasvxup.hvs
C:\bug.txt
C:\Users\Nick\AppData\Local\Temp\7zSEF21.tmp
C:\Users\Nick\AppData\Local\Temp\a2temp
C:\Users\Nick\AppData\Local\Temp\BCGFA17.tmp
C:\Users\Nick\AppData\Local\Temp\IUJ49358Swap.tmp
C:\Users\Nick\AppData\Local\Temp\MGI279C.tmp
C:\Users\Nick\AppData\Local\Temp\MGI2A99.tmp
C:\Users\Nick\AppData\Local\Temp\MGI3248.tmp
C:\Users\Nick\AppData\Local\Temp\MGI53BA.tmp
C:\Users\Nick\AppData\Local\Temp\MGI5743.tmp
C:\Users\Nick\AppData\Local\Temp\MGI5A06.tmp
C:\Users\Nick\AppData\Local\Temp\MGI9C00.tmp
C:\Users\Nick\AppData\Local\Temp\MGIBC55.tmp
C:\Users\Nick\AppData\Local\Temp\MGID782.tmp
C:\Users\Nick\AppData\Local\Temp\MGIF824.tmp
C:\Users\Nick\AppData\Local\Temp\MGIFFF9.tmp
C:\Users\Nick\AppData\Local\Temp\MMC1829.tmp
C:\Users\Nick\AppData\Local\Temp\MMC3893.tmp
C:\Users\Nick\AppData\Local\Temp\MMC3B42.tmp
C:\Users\Nick\AppData\Local\Temp\MMC4217.tmp
C:\Users\Nick\AppData\Local\Temp\MMC6716.tmp
C:\Users\Nick\AppData\Local\Temp\MMC6E54.tmp
C:\Users\Nick\AppData\Local\Temp\MMC943B.tmp
C:\Users\Nick\AppData\Local\Temp\MMCA847.tmp
C:\Users\Nick\AppData\Local\Temp\MMCCABC.tmp
C:\Users\Nick\AppData\Local\Temp\MML12B8.tmp
C:\Users\Nick\AppData\Local\Temp\MML2EED.tmp
C:\Users\Nick\AppData\Local\Temp\MML312E.tmp
C:\Users\Nick\AppData\Local\Temp\MML39A9.tmp
C:\Users\Nick\AppData\Local\Temp\MML5F54.tmp
C:\Users\Nick\AppData\Local\Temp\MML675C.tmp
C:\Users\Nick\AppData\Local\Temp\MML86AF.tmp
C:\Users\Nick\AppData\Local\Temp\MMU12CB.tmp
C:\Users\Nick\AppData\Local\Temp\MMU2EF1.tmp
C:\Users\Nick\AppData\Local\Temp\MMU3142.tmp
C:\Users\Nick\AppData\Local\Temp\MMU39AD.tmp
C:\Users\Nick\AppData\Local\Temp\MMU5F77.tmp
C:\Users\Nick\AppData\Local\Temp\MMU6760.tmp
C:\Users\Nick\AppData\Local\Temp\MMU86E2.tmp
C:\Users\Nick\AppData\Local\Temp\MMUA24E.tmp
C:\Users\Nick\AppData\Local\Temp\MMUC159.tmp
C:\Users\Nick\AppData\Local\Temp\MMV12BA.tmp
C:\Users\Nick\AppData\Local\Temp\MMV2EEF.tmp
C:\Users\Nick\AppData\Local\Temp\MMV3140.tmp
C:\Users\Nick\AppData\Local\Temp\MMV39AB.tmp
C:\Users\Nick\AppData\Local\Temp\MMV5F56.tmp
C:\Users\Nick\AppData\Local\Temp\MMV675E.tmp
C:\Users\Nick\AppData\Local\Temp\MMV86E0.tmp
C:\Users\Nick\AppData\Local\Temp\MMVA24C.tmp
C:\Users\Nick\AppData\Local\Temp\MMVC147.tmp
C:\Users\Nick\AppData\Local\Temp\restart.a2s
C:\Users\Nick\AppData\Local\Temp\svjd7.tmp

Folders to delete:
C:\327882R2FWJFW
Click to expand...

Now click the Execute button.

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

C:\avenger.txt

C:\MGlogs.zip

Make sure you tell me how things are working now!

Felix Felicis · Aug 9, 2008

Sorry about the duplicate thread - I'll know for next time.

Anyway:
I'm running Vista Home 32bit, and I downloaded a file which was masquerading as an mp3, and I'm now sure was a virus. There were no symptoms up until a few days ago, when suddenly I could no longer access gmail.com or some of my other frequented sites. Firefox would give me an error along the lines of "server could not be found". I also tried the sites in Safari, to no success.
Then, some websites stopped displaying images properly, notably bebo.com.
Next, icons and images on my desktop started disappearing. My wallpaper would go black, and files would lose their icons, becoming only a name.

Nothing was picked up during scans, so I backed everything up on DVDs and formatted my computer, re-installing Vista. Everything seemed fine, but not, I'm intermittently forbidden access to Gmail again. I'm now worried that something malignant got backed up and then put back into my system.
As of last night, my wallpaper is gone and icons are disappearing.
I've attached my logs here (as I'm not allowed to reupload the same files), though I cannot run combofix - I'm given an error message about having an incompatible OS. The scans turned up pretty much clean, except for spybot finding a couple of funny cookies.

I realise these problems aren't too serious, I just worry that they might be the only visible symptoms of a deeper problem.

chaslang · Aug 9, 2008

If you have reinstalled your system after a format then you are not having malware problems. And your last logs in the other thread agree since they are clean. Something went wrong with your installation or you are reinstalling something that is causing a problem.

I suggest that you clearly explain each of your problems in a new thread in the Software Forum. Also make sure you explain that you just reinstalled and also make sure you explain anything else you installed and did after installing Vista.

Felix Felicis · Aug 10, 2008

OK - I'll do that and hope for the best. Thanks a lot!

chaslang · Aug 10, 2008

You're welcome. Surf safely!

Log in or Sign up

Possible Vundo infection?

Felix Felicis Private E-2

Attached Files:

mbam-log-8-6-2008 (18-29-14).txt

SUPERAntiSpyware Scan Log - 08-06-2008 - 18-08-01.log

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Felix Felicis Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Felix Felicis Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member