Virtumondo.C

MGeorge · Nov 16, 2005

I have gone through READ & RUN ME FIRST, but Microsoft Antispyware is still finding Virtumode signatures in the registry. Any help you can offer would be of great help. This virus has really been bothering me and slowing down my computer. I have also gotten a few emails saying that I have been sending out viruses. The processes I ran this evening found Win32, Virtumondo.C, Virtumonde, and something else I cannot recall. I have run HiJackThis...here is my log:

Edit by chaslang: Incomplete inline log removed

chaslang · Nov 16, 2005

It does not appear that you ran at least two of the online scanners requested in step 5 of the READ ME. Is there a reason for not running them.

Please read the step 7 of the READ & RUN ME again and install and run HijackThis properly for future logs. All logs must be attachments and they must be unedited. To repeat part of step 7 here:

Make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Also before you attach a new log, I would recommend that you first run the steps in the below link and attach the SpySweeper log (then attach a new HJT log).

Running Spy Sweeper...

MGeorge · Nov 17, 2005

I did run 2 scans from Step 5. Oh well.

I installed and ran SpySweeper.
I ran HiJackThis again.

Any help would be appreciated.

chaslang · Nov 17, 2005

Okay! Perhaps I missed something the first time and did not notice the two online scans which I do see know. I apologize!

Did you want the two below R1 settings?
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=VOB

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: (no name) - {48F8D92D-2C3C-4BB6-9B66-7F30E0A5FB13} - C:\WINDOWS\mindep.dll (file missing)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O15 - Trusted Zone: http://*.63.219.181.7
O20 - Winlogon Notify: mllmk - C:\WINDOWS\system32\mllmk.dll (file missing)

After clicking Fix, exit HJT.

Now reboot in normal mode and post a new HJT log. And tell us how things are working now?

MGeorge · Nov 17, 2005

Everything seems to be working much better, but in the newest HiJackThis log, there was no "Trusted Site" so I could not remove it...It is still there.

Here is the log. Let me know what you think.

chaslang · Nov 17, 2005

Uninstall or disable SpySweeper's protections. It may be blocking the fixes I gave you. Then rerun the previous fix. If that does not help, we may need to do the same with MS Antispyware.

MGeorge · Nov 17, 2005

I uninstalled SpySweeper and ran HiJack.
The trusted site was still not there.

So I disabled MS Antispyware realtime protection.
I ran Hijack again and it still wasnt there.
Here is the log.

Let me know what you think.

chaslang · Nov 17, 2005

We are not looking for the Trusted Site anymore. Just the other items we were trying to fix. Now they are fixed.

Just have HJT fix the below remnant from SpySweeper:
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

How are things working?

Note: HJT logs should always be from normal boot mode unless specified otherwise. So maybe you should boot into normal mode and post another hopefully final log.

MGeorge · Nov 17, 2005

Well, I ran it from normal mode and the trusted site popped up in addition to the other item you mentioned...

Here is the log...(I already fixed those two items).

chaslang · Nov 17, 2005

MGeorge said:

Well, I ran it from normal mode and the trusted site popped up in addition to the other item you mentioned...
Click to expand...

Which other item?

Also in message number 4 I asked the below:

Did you want the two below R1 settings?
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/...dir.asp?Ext=VOB
Click to expand...

chaslang · Nov 17, 2005

Let's see if we can remove the TZ IP address.

Run IE, select Tools, Internet Options. Now select Security and then click the Trusted Sites circle. Then click the Sites button. Look for the *.63.219.181.7 address in the Web sites box and select it. Then click Remove. Then at the bottom make sure there is a check mark in the box that says Require server verification...... blah blah. Now click OK. And OK again.

MGeorge · Nov 17, 2005

Well, I ran HiJack again.

To answer your question, I last removed two items...the trusted zone and the remnant of spysweeper.

I just ran Hijack again...deleted the two R1 items you mentioned and the TZ which reappeared.

Then I tried to remove the TZ via internet options and was told the administrator placed a restriction on options.

Here is the log file from before I "fixed" the two R1 items and the TZ.

MGeorge · Nov 17, 2005

I restarted and the Internet Options thing allowed me in this time...

But as it had before all this stuff, the TZ popped back into trusted sites right after I removed it.

chaslang · Nov 17, 2005

MGeorge said:

I restarted and the Internet Options thing allowed me in this time...

But as it had before all this stuff, the TZ popped back into trusted sites right after I removed it.
Click to expand...

Were you logged in with Administrator priviledges when you fixed it? And what method did you use to fix it? Using HJT will more than likely not work.

Don't waste time posting unnecessary logs before fixes. Only post them after running the fixes.

You may need to uninstall MS Antispyware too.

MGeorge · Nov 18, 2005

I uninstalled MS Antispyware.

Now, here is my log.
What am I gonna have to do to get rid of this trusted site?

Let me know what you think.

chaslang · Nov 18, 2005

I repeat my question from my last message!

Were you logged in with Administrator priviledges when you fixed it? And what method did you use to fix it? Using HJT will more than likely not work.
Click to expand...

chaslang · Nov 18, 2005

Download RemV3.Zip to your computer somewhere you can find it.

Extract all the files to a folder (make it a folder for only these tools).
Then boot into safe mode and run the remv3.bat file.

MGeorge · Nov 18, 2005

I was the administrator and just trying to use HJT...It did not work.
As expected.

chaslang · Nov 18, 2005

Do what I gave to you in message # 17?

Then let me know your status.

MGeorge · Nov 18, 2005

I did what you said in #17.

It deleted a few files and said one was left to do manually....
"msi.dll"

Just let me know what is next.

chaslang · Nov 18, 2005

Did you run it in safe mode?

Have you rebooted in normal mode afterwareds? If so, post a new HJT log from normal boot mode.

MGeorge · Nov 18, 2005

I did run the Batch file from safe mode...
I rebooted...here is the HJT file.

chaslang · Nov 18, 2005

Make sure you are log in with Administrator priviledges and try message # 11 again.

MGeorge · Nov 18, 2005

Tried and failed.

It was there again right after I clicked ok, ok...

chaslang · Nov 18, 2005

It would seem that something is blocking some of the fixes. The REMV3.Bat fix normally fixes the problems. It could be that your Norton AV is blocking some fixes.

Boot into safe mode and disable any Norton processes from running. Make sure you are physically disconnected (unplug your cable) and that no browsers are opened and then run the remv3.bat file again. Then reboot in normal mode and let me know if the O15 line is gone.

MGeorge · Nov 18, 2005

I disabled Norton...
I ran the batch file in safe...
Back in normal...ran HJT but O15 is still there

chaslang · Nov 18, 2005

Do you know how to use regedit? If so, I want you to look to see if you find any of the below registry keys:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd\Files]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd\Processes]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd\RegKeys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd\RegValues]

MGeorge · Nov 18, 2005

chaslang said:

Do you know how to use regedit? If so, I want you to look to see if you find any of the below registry keys:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd\Files]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd\Processes]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd\RegKeys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ms4Hd\RegValues]
Click to expand...

I looked in regedit, but the ...\Ms4Hd\ folder was not there nor were its contents.

chaslang · Nov 18, 2005

Please download DelDomains and unzip it to your desktop.

Find the files from deldomains.zip on your Desktop and RightClick on the deldomains.inf file and select Install.

(Please note if you have Spybot S&D installed you will need to "Immunize" again because deldomains will remove all of the sites Spybot adds.)

Is the O15 line still there? If so, run the below:

Download WinPFind

Extract it to the root folder of drive C ( C:\ ). This will create a folder called WinPFind in the C:\ folder. Inside c:\WinPFind is a file called WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

When it is done, it will show the results of the scan. Click on the Copy to Clipboard button and then paste the contents of the log in your clipboard. Then save it to a file using notepad and upload the text file here as an attachment.

MGeorge · Nov 18, 2005

Hooray.
After installing deldomains, the HJT did not have an O15...
AND it is gone from interenet tools.

Do you think I still need to run the WinPFind?
Or am I good?

Thank you for all your help.

My Norton AV subscription runs out tomorrow...what would you suggest I replace it with???

MGeorge · Nov 18, 2005

Can/Should I reinstall MS Antispyware?

chaslang · Nov 18, 2005

MGeorge said:

Hooray.
After installing deldomains, the HJT did not have an O15...
AND it is gone from interenet tools.

Do you think I still need to run the WinPFind?
Or am I good?

Thank you for all your help.

My Norton AV subscription runs out tomorrow...what would you suggest I replace it with???
Click to expand...

Make sure you reboot! And then check again! Did you re-immunize with Spybot?

Answers to which AV are in another sticky thread which you should now work thru if still clean:

How to Protect yourself from malware!

Do not re-install MS Antispyware until you reboot and make sure the O15 line is still gone. If the O15 comes back, then run WinPfind otherwise do not run WinPfind.

MGeorge · Nov 18, 2005

I did re-Immunize with SpyBot. I rebooted and am still clean...
Again, thank you.
Since you advise against using multiple antipyware programs simultaneously and I already have SpyBot and AdAware installed...should I uninstall them and then install MS Antispyware? Should I keep them all on the computer but not running?
When I download one of the free antivirus programs, should I uninstall Norton?

Just logistical questions now...thanks.

chaslang · Nov 18, 2005

MGeorge said:

ISince you advise against using multiple antipyware programs simultaneously and I already have SpyBot and AdAware installed...should I uninstall them and then install MS Antispyware? Should I keep them all on the computer but not running?
When I download one of the free antivirus programs, should I uninstall Norton?
.
Click to expand...

We advise against multiple AV programs running, not multiple antispyware. However using mutliple full blown AS programs like Ewido, MS Antispyware, SpySweeper, and CounterSpy can be a resource hog. Ad-Aware (free version), SpywareBlaster and Spybot (as long as you do not use Teatimer) are not resource intensive and really only use signifcant resources when scanning. Thus you can keep all of them.

Download the new AV that you choose. Then uninstall Norton. Then install the new AV and get its updates. Then run a fullscan with it.

Virtumondo.C

MGeorge Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

Attached Files:

MGeorge Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

MGeorge Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

MGeorge Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member