Vundo/Virtumonde - are my logs clean??

Discussion in 'Malware Help (A Specialist Will Reply)' started by rockinruby, Dec 18, 2008.

  1. rockinruby

    rockinruby Private E-2

    Here are the logs generated by following the laborious steps outlined on this site. (very clear instructions, by the way!!)

    Can you tell me if my system is now clean? (please say yes!!) If not, how should I proceed? :cry

    Thanks!
     

    Attached Files:

  2. rockinruby

    rockinruby Private E-2

    Last log file attached here.
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, your logs are clean. :)

    DO this though:

    Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Now download and install:
    Java Runtime 6

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
  4. rockinruby

    rockinruby Private E-2

    Hi Tim,

    Thanks for your response. The logs were done on my husband's computer. I had rebooted a couple of times and done some surfing and had no problems. He came home, visited just three sites:

    CNN www.cnn.com
    Craigslist www.craigslist.com
    Rhapsody www.rhapsody.com

    And bim, bam, boom, AVG advised him of the same Vundo virus in some backup versions of Windows on his computer. These were the same messages he had gotten before. I'm not sure we have this licked yet. Or if we did have it licked, and he's reinfected, how do we prevent that from happening over and over?? Your clean up process took me literally hours!

    I don't think he has Java runtime installed on that machine at all. Is there some reason I need to install it?? He tries to keep that machine very minimalist, you may have noticed.

    THANKS!
     
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You have to be more specific --> some backup version? Are you referring to a file in the system restore folder or what? Tell me exactly what AVG is reporting.
    Yes he should have Java installed.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds