win32 banker fs (problems with removal)

Silver Trowel · Nov 13, 2008

Hi, Appologies if my problem is an easily solved one but Im a computer newbie as far as these things go.
I have to do things step by step and have then explained to me that way.

I picked up the win32 banker fs trojan thingy and came here for a soloution. I quickly found it under Chaslangs Read and Run Malaware removal post.
I completed every step in order until I got to the spybot search + destroy part.
I installed the programme but every time i ran it (6 times so far) it tells me it recomends that I reboot (About 1/3rd the way thro the scan). This happens just as it identifies a problem ... virtumunde.dll ....
I rebooted everytime and search+destroy starts up again (B4 my settings have loaded) but the same problem arises.

Am i doing somtin wrong?
What is virtumunde.dll?

Thnx for any help in advance.

Silver Trowel · Nov 13, 2008

just incase, thought i should show exactly what search+destroy finds b4 recomending a reboot,,,,,,

Virtumunde.dll: [SBI $AAFAEA2E] Library
C:\WINDOWS\system32\xrxqbskj.dll

Virtumunde.dll: [SBI $AAFAEA2E] Library
C:\WINDOWS\system32\xgsjuygp.dll

Virtumunde.dll: [SBI $AAFAEA2E] Library
C:\WINDOWS\system32\lyppjjqt.dll

Virtumunde.dll: [SBI $AAFAEA2E] Library
C:\WINDOWS\system32\wucjdaao.dll

Virtumunde.dll: [SBI $AAFAEA2E] Library
C:\WINDOWS\system32\aqfhbyrq.dll

TimW · Nov 14, 2008

Stop running spybot and instead try running and getting me the logs from:
SuperAntispyware
MalwareBytes
ComboFix
MGTools.exe ---> C:\MGLogs.zip

In the meantime, download The Avenger by Swandog469, and save it to your Desktop.

* Extract avenger.exe from the Zip file and save it to your desktop
* Run avenger.exe by double-clicking on it.
* Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the "Input script here:"
part of the window:

Files to delete:
C:\WINDOWS\system32\xrxqbskj.dll
C:\WINDOWS\system32\xgsjuygp.dll
C:\WINDOWS\system32\lyppjjqt.dll
C:\WINDOWS\system32\wucjdaao.dll
C:\WINDOWS\system32\aqfhbyrq.dll
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Attach that log as well.

Silver Trowel · Nov 17, 2008

Ty for taking the time to reply my friend, but I think Ive fixed the problem...
Please dont ask me how,,, my head hurts :-o

The only thing im having trouble with is setting my homepage... it just auto reverts to MSN homepage after every attempted change :confused

TimW · Nov 17, 2008

Not seeing your logs it is hard to say whether you are clean or not. Your homepage is probably being blocked by one of your security programs.

Log in or Sign up

win32 banker fs (problems with removal)

Silver Trowel Private E-2

Silver Trowel Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Silver Trowel Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member