Spware.Virtumonde -- Can't Remove -- Please Help

Please read the announcement and sticky threads. HJT logs should only be posted when requested and then they must be attachments to your message. Also note that HJT must be installed properly and must be run from normal boot mode.


Please run the steps below.

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem, boot into normal mode and make sure you follow these directions:


- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

Then download the below tools and extract them to their own folders (someplace you will be able to find them later).

- Process Explorer 9.2

- Pocket KillBox

Do not run them now! Just download and extract them for later use. We will need them to make the final fixes for the Virtumundo problem.

 

Reboot in Safe Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of acctapi.dll once and then click the kill button. After you have killed all of theacctapi.dll's under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of acctapi.dll then click the kill button. Once you have done that click ok again. (If you do not find the dll, just continue on.)

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\Web\printers\acctapi.dll
O15 - Trusted Zone: www.excite.com
O15 - Trusted Zone: *.xdrive.com
O20 - Winlogon Notify: acctapi - C:\WINDOWS\Web\printers\acctapi.dll

Copy the bold text below to notepad. Save it as fixVundo.reg to your desktop. Be sure the "Save as" type is set to "all files". Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot.

C:\WINDOWS\Web\printers\acctapi.ini
C:\WINDOWS\Web\printers\acctapi.ini2
C:\WINDOWS\Web\printers\acctapi.bak
C:\WINDOWS\Web\printers\acctapi.bak2
C:\WINDOWS\Web\printers\acctapi.tmp
C:\WINDOWS\Web\printers\acctapi.dll

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot post a new HJT log.

 

Your log is now clean! If things are still looking good, you should complete the steps in the below thread to help keep you clean:

How to Protect yourself from malware!

 

You're welcome! Surf safely!