Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Vundo Trojan....i Can't Get Remove It.


  • Please log in to reply
4 replies to this topic

#1 Guest_nerdyfashionista18_*

Guest_nerdyfashionista18_*

  • Guests
  • OFFLINE
  •  

Posted 23 February 2008 - 04:56 AM

[02/23/2008, 4:31:16] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ERiCA\Desktop\VirtumundoBeGone.exe" )
[02/23/2008, 4:31:25] - Detected System Information:
[02/23/2008, 4:31:26] - Windows Version: 5.1.2600, Service Pack 2
[02/23/2008, 4:31:26] - Current Username: ERiCA (Admin)
[02/23/2008, 4:31:26] - Windows is in NORMAL mode.
[02/23/2008, 4:31:26] - Searching for Browser Helper Objects:
[02/23/2008, 4:31:27] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} ()
[02/23/2008, 4:31:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/23/2008, 4:31:28] - No filename found. Continuing.
[02/23/2008, 4:31:28] - BHO 2: {393C2547-B2AB-422C-87AF-385238C73416} ()
[02/23/2008, 4:31:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/23/2008, 4:31:29] - Checking for HKLM\...\Winlogon\Notify\urqronk
[02/23/2008, 4:31:29] - Found: HKLM\...\Winlogon\Notify\urqronk - This is probably Virtumundo.
[02/23/2008, 4:31:29] - Assigning {393C2547-B2AB-422C-87AF-385238C73416} MSEvents Object
[02/23/2008, 4:31:29] - BHO list has been changed! Starting over...
[02/23/2008, 4:31:29] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} ()
[02/23/2008, 4:31:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/23/2008, 4:31:29] - No filename found. Continuing.
[02/23/2008, 4:31:29] - BHO 2: {393C2547-B2AB-422C-87AF-385238C73416} (MSEvents Object)
[02/23/2008, 4:31:29] - ALERT: Found MSEvents Object!
[02/23/2008, 4:31:30] - BHO 3: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Windows Live Toolbar Helper)
[02/23/2008, 4:31:31] - BHO 4: {C3271274-37C5-4913-AE50-6BF3409DE4EB} ()
[02/23/2008, 4:31:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/23/2008, 4:31:31] - Checking for HKLM\...\Winlogon\Notify\awtqr
[02/23/2008, 4:31:31] - Key not found: HKLM\...\Winlogon\Notify\awtqr, continuing.
[02/23/2008, 4:31:31] - Finished Searching Browser Helper Objects
[02/23/2008, 4:31:31] - *** Detected MSEvents Object
[02/23/2008, 4:31:31] - Trying to remove MSEvents Object...
[02/23/2008, 4:31:32] - Terminating Process: IEXPLORE.EXE
[02/23/2008, 4:31:35] - Terminating Process: RUNDLL32.EXE
[02/23/2008, 4:31:36] - Disabling Automatic Shell Restart
[02/23/2008, 4:31:37] - Terminating Process: EXPLORER.EXE
[02/23/2008, 4:31:38] - Suspending the NT Session Manager System Service
[02/23/2008, 4:31:40] - Terminating Windows NT Logon/Logoff Manager
[02/23/2008, 4:31:43] - Re-enabling Automatic Shell Restart
[02/23/2008, 4:31:43] - File to disable: C:\WINDOWS\system32\urqronk.dll
[02/23/2008, 4:31:43] - Renaming C:\WINDOWS\system32\urqronk.dll -> C:\WINDOWS\system32\urqronk.dll.vir
[02/23/2008, 4:31:44] - File successfully renamed!
[02/23/2008, 4:31:44] - Removing HKLM\...\Browser Helper Objects\{393C2547-B2AB-422C-87AF-385238C73416}
[02/23/2008, 4:31:44] - Removing HKCR\CLSID\{393C2547-B2AB-422C-87AF-385238C73416}
[02/23/2008, 4:31:44] - Adding Kill Bit for ActiveX for GUID: {393C2547-B2AB-422C-87AF-385238C73416}
[02/23/2008, 4:31:45] - Deleting ATLEvents/MSEvents Registry entries
[02/23/2008, 4:31:45] - Removing HKLM\...\Winlogon\Notify\urqronk
[02/23/2008, 4:31:45] - Searching for Browser Helper Objects:
[02/23/2008, 4:31:45] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} ()
[02/23/2008, 4:31:46] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/23/2008, 4:31:46] - No filename found. Continuing.
[02/23/2008, 4:31:46] - BHO 2: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Windows Live Toolbar Helper)
[02/23/2008, 4:31:47] - BHO 3: {C3271274-37C5-4913-AE50-6BF3409DE4EB} ()
[02/23/2008, 4:31:47] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/23/2008, 4:31:47] - Checking for HKLM\...\Winlogon\Notify\awtqr
[02/23/2008, 4:31:47] - Key not found: HKLM\...\Winlogon\Notify\awtqr, continuing.
[02/23/2008, 4:31:48] - Finished Searching Browser Helper Objects
[02/23/2008, 4:31:49] - Finishing up...
[02/23/2008, 4:31:49] - A restart is needed.
[02/23/2008, 4:32:02] - Attempting to Restart via STOP error (Blue Screen!)

[02/23/2008, 4:37:14] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ERiCA\Desktop\VirtumundoBeGone.exe" )
[02/23/2008, 4:37:16] - Detected System Information:
[02/23/2008, 4:37:16] - Windows Version: 5.1.2600, Service Pack 2
[02/23/2008, 4:37:17] - Current Username: ERiCA (Admin)
[02/23/2008, 4:37:17] - Windows is in NORMAL mode.
[02/23/2008, 4:37:17] - Searching for Browser Helper Objects:
[02/23/2008, 4:37:17] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} ()
[02/23/2008, 4:37:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/23/2008, 4:37:18] - No filename found. Continuing.
[02/23/2008, 4:37:18] - BHO 2: {B19ED4DD-A794-4DE8-938B-D9766921480B} ()
[02/23/2008, 4:37:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/23/2008, 4:37:18] - Checking for HKLM\...\Winlogon\Notify\awtqr
[02/23/2008, 4:37:18] - Key not found: HKLM\...\Winlogon\Notify\awtqr, continuing.
[02/23/2008, 4:37:18] - BHO 3: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Windows Live Toolbar Helper)
[02/23/2008, 4:37:18] - Finished Searching Browser Helper Objects
[02/23/2008, 4:37:18] - Finishing up...
[02/23/2008, 4:37:19] - Nothing found! Exiting..


I'm not sure if this is what I was supposed to post. Sorry if it wasn't. But I need help.

BC AdBot (Login to Remove)

 


m

#2 Guest_nerdyfashionista18_*

Guest_nerdyfashionista18_*

  • Guests
  • OFFLINE
  •  

Posted 23 February 2008 - 05:04 AM

did I post the wrong thing?

#3 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  

Posted 23 February 2008 - 05:13 AM

Welcome to the BleepingComputer HijackThis Logs and Analysis forum.
My name is Richie and i'll be helping you to fix your problems.

Please follow the info in the link below.
Preparation Guide for use before posting a HijackThis Log:
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

When you've finished that,post a Hijackthis log into this topic.

*Note*
Post all reports/logs directly into this topic,not as attachments or inside code boxes,thanks.
Posted Image
Posted Image

#4 Guest_nerdyfashionista18_*

Guest_nerdyfashionista18_*

  • Guests
  • OFFLINE
  •  

Posted 23 February 2008 - 05:48 AM

I'm sorry, I can't download all that stuff on my laptop. The virus seems to just not go away no matter what I do.

#5 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  

Posted 23 February 2008 - 06:44 AM

Download Combofix by sUBs and save to your desktop.
Alternative Combofix download link HERE.
Note
It is important that it is saved directly to your desktop


Now close any open browsers.
Double click on Combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the entire contents of C:\ComboFix.txt into your next reply.
Note
Do not mouseclick combofix's window or do anything else on your pc while it's running.
That may cause the program/system to freeze/hang.

Do NOT post the ComboFix-quarantined-files.txt unless I ask.
Note
In case your Antivirus or any other realtime scanner is displaying an alert after you downloaded Combofix or while you use Combofix,please disable your scanner and redownload Combofix again.
Some scanners may see some combofix related components as suspicious and block or delete them while there's nothing wrong with them.

Also post a new Hijackthis log please.
Posted Image
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users