Virtumonde infection; logs attached

Discussion in 'Malware Help (A Specialist Will Reply)' started by Valgrindar, Dec 25, 2008.

  1. Valgrindar

    Valgrindar Private E-2

    Hi,

    I recently got a Virtumonde infection on my machine, and followed the instructions in the "READ & RUN ME FIRST" topic. I can't say for sure if the symptoms are gone, since I have only been connecting to the internet to download suggested programs and update definitions. Despite having finished all this, there are still a few problems:

    MSConfig cannot be found by the Run command. I can go to Start > Search and search "msconfig", with successful results, but I am concerned with the fact that Run cannot launch it.

    An error which reads "The instruction at '0x0012e854' referenced memory at '0xffffff91'. The memory could not be 'written'." displays upon every startup, prior to logging in.

    A second error message reading "LMGRD encountered a problem and needed to close" appears after logging in.

    In addition to all of this, it is quite sluggish while starting up. After starting it seems fine (though I can't say for sure, since I haven't done anything that would particularly strain the machine).

    I'm not sure if these errors are showing up because of the virus trying to start up its own sub-applications but failing due to a lack of files, or if I've genuinely messed up some important files.

    Logs are attached to help figure it out.

    Thanks!

    - Reilly
     

    Attached Files:

    Valgrindar, Dec 25, 2008
    #1
  2. Valgrindar

    Valgrindar Private E-2

    Post 2/2
     

    Attached Files:

    Valgrindar, Dec 25, 2008
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You may wish to use a Startup Manager. You have a very large amount of items loading.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    I am not seeing any malware in your logs. I would suggest that you post in the software section for your slowness issues.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, Dec 27, 2008
    #3
  4. Valgrindar

    Valgrindar Private E-2

    Thank you!

    As for the large amount of items, I would attribute that to the fact that my school supplied me with this computer, so it has a lot of engineering software that launches upon start up. The slowness has ceased, and I'm pretty sure that it was due to the fact that I hadn't changed MSConfig back from Normal Start Up.

    As for no more malware being present, it seemed like everything had gone after I made this post, but I didn't want to make any assumptions.

    Anyway, everything is back to normal, and thanks again! =)
     
    Valgrindar, Dec 28, 2008
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome....safe surfing. :)
     
    TimW, Dec 28, 2008
    #5

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds