My friend brought his computer to me a couple days ago. He told me that he thinks he has a virus. After trying to fix it for the last two nights, I have decided that the problem is beyond my area of expertise. While searching for information on the web, I stumbled here and thought it would be a good idea to request assistance. I will try to detail as much as I know about the computer and what I did in this post.
- Computer is sluggish (XP Pro SP3)
- Before I uninstalled it, an older version of Java (5 something) was on his computer
- Pop up ads occasionally appear while browsing the web in Firefox 18.104.22.168
- I have turned off system restore
- I have tried clearing out all the cache files and temporary files
- I ran Spybot and it told me that Virtumonde was on the system, but it could not remove the files
- I tried running VundoFix, which did not find anything
- I uninstalled an outdated version of McAfee and installed Avast!, which detects a rootkit every now and then
- I disabled the following startup processes and deleted the corresponding files from C:\windows\system32 : mirajehi.dll (rundll32.exe "c:\windows\system32\mirajehi.dll", b ) ; jogihuju (rundll32.exe "c:\windows\system32\jogihuju.dll",a) ; vowunaka (rundll32.exe "c:\windows\system32\vowunaka.dll",s)
- Last night, I made Avast! run a scan before booting into the Windows environment. It put two files in quarantine: 140.htm from C:\Documents and Settings\Administrator.BOSTON-Y82R7LRE\Local Settings\Temporary Internet Files\Content.IE5\QXINFE9Q, which Avast! identifies as JS:FakeAV-J [Trj] and yogobeyi.dll from C:\windows\system32, which is identified as Win32:Rootkit-gen [Rtk]
- Upon starting it up tonight, I noticed that there are two new suspicious startup processes similar to the aforementioned examples: zuzogomi.dll and sayiwido.dll. Additionally, it seems as if it has killed the real time scanning afforded by Avast!
This is about all I can remember right now. If there's anything I overlooked, please let me know. I appreciate whatever help I can get with regards to this problem.
Thank you in advance.
Edited by burningdarkness, 01 April 2009 - 08:18 PM.