winlogonhook and virtumonde infection

firstly thanks 2 anyone helping with my problem.
i seemed to have gotten the trojan winlogonhook and virtumonde infections on my computer have tried your suggestions spysweepr and avg antispyware but still seem to have them there please help.
log files are attached.

 

hjt log also
thanks

 

Hi hoopea,
Welcome to Major Geeks!

Please go back and run the scans and follow the instructions in the READ & RUN ME FIRST. There is a new variant of Vundo which is particularly dangerous and these scans will allow us to see if that is present in your computer. When you finish, attach the requested logs with your next post.

abri

 

hi abri here are the other files you were after cheers

 

Hi hoopea,
Please go back and rerun Superantispyware and have it fix what it finds. It only says it detected certain things. There should be an option to have it fix things.
abri

 

Hi hoopea,

After you finish with the instruction in post 5, please continue with the following:

First, a comment: You're missing a lot of Windows updates. Why? This makes your computer very vulnerable. After we finish cleaning your computer, I will ask you to download and install them. This can be done either automatically or manually and you can read about each one if you want to take the time to do it.

Now I would like for you to do the following:

1) Please begin by disabling your guest account if this has not been done already.

2) Next go to add/remove programs and uninstall the below:

Java(TM) 6 Update 2
Java(TM) 6 Update 3

3) Reboot after uninstalling the above.

4) Install the current version of Sun Java from: Sun Java Runtime Environment

5) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger

6) Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

04 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O20 - Winlogon Notify: fcccawx - fcccawx.dll (file missing)
O20 - Winlogon Notify: iifedbx - iifedbx.dll (file missing)


After you click fix, just close hijackthis.


7) Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

8) Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


9) Please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip it generates along with the Avenger log.


Let me know how things are running now?

abri

 

hi abri,
cheers for responding
Have done the steps you have suggested please find attached.
With regards to the windows updates the computer i thought was doing that automatically turns out it has not. I will definately do them afterwards!
Computer seems to b running well but i'am just concerned about using the internet until hopefully these problems are fixed.

 

hi abri,

Dont know if this would help but just did a kaspersky online scan and it came up with this.

 

Hi Hoopea,

What is AV in your add/remove programs list?

The below entries are still showing in your runkeys log although Avenger shows them as having been deleted.

1) Download and install Erunt. Use it to create a backup of your registry.

2) Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

3) The Kaspersky was helpful, but it's a pain that they won't fix what they find. Please go ahead and do the following scans and be sure to have them fix whatever they find. These two require that you use Internet Explorer. Also, please run the BitDefender before the Panda. These are long scans, at least 1-2 hours each.

Running BitDefender Online Scan

Running Panda Active Scan

When you complete the above, please get the logs according to the instructions and attach them here.

Thanks.
abri

 

Hi Abri.
Dont know what the AV program was in add/remove programs list when i went to look it was not there.
I have run the scans you asked and done the reg edit, scans coming up with a few things. Hope they can be fixed.
Today my norton 360 picked up the vundo infection a bit slow to pick up(like 5 days behind)thinking about getting rid of it and getting something else.
anyway please find the scan logs attached.
thanks hoopea

 

Hi hoopea,

A lot ot what BitDefender came up with are things in either your quarantines or your restore points. The Nortons quarantine can be cleaned out using the following instructions: Removing Files from Norton Antivirus Quarantine

After you do that, please run Combofix and GetLogs.bat again and post the ComboFix log and the MGlogs.zip (found directly under C above the superman icon).

abri

 

Hi Abri,

tried to delete the norton 360 quarantine files but could not, spoke to a cust. service rep. and they said 360 does not allow this.
so i have just done the scans you have asked

 

Hi hoopea,
Your logs are clean. The many entries in Kaspersky are in different quarantines like the one for Vundofix or for Nortons where those files will not infect your computer. You can still make the following two changes:

1) Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"

After you click fix, just close hijackthis.

2) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger

After you've done these two steps, please run the final cleanup instructions which will include setting a clean restore point. When you do this, you will wipe out all the previous infected restore points.

abri

 

HI Abri,

thanks so much for your help over the last few days, computer seems to be better now. I am sure to follow the steps in the malware link you provided theres some good tips!
just wish there was more people like the you and the rest at majorgeeks willing to help and not try to scam on the net but thats life.:guns
many thanks to you and the team at majorgeeks

hoopea
:highfive:highfive

 

Your welcome Hoopea!
Enjoy your computer!
abri