Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected by Virtumonde...need help


  • This topic is locked This topic is locked
10 replies to this topic

#1 Jtcmu

Jtcmu

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:18 AM

Posted 08 November 2009 - 09:11 AM

Hi,

Recently my computer has been attacked by Virtumonde (or Virtumundo). Symptoms first appeared when ads started popping up while using my internet browser. I then attempted to download Malwarebytes, however when I installed the program it deleted the mbam.exe file immediately after installation, making it so I could not use the program. However, I was able to pull a couple maneuvers and get the mbam.exe file on my system. I have run the Malwarebytes program several times (with and without being connected to the internet and having system restore on/off). Each time, it finds approximately 10 infections related to Virtumundo, and asks me to restart. When I restart my computer, all the processes that normally start at startup bring up an error box saying that some .dll file (the name of which is arbitrary and seems to change after each time I run Malwarebytes and remove it) is not a valid image. I can run malwarebytes again and it finds nothing. However, my computer runs much slower and seems to be using a lot more CPU than normal. Once I get online, the virus re-infects itself and I am back to square one.

I have attached the most recent HiJackThis log that I made before writing this post. I would greatly appreciate any help!

Josh

Attached Files



BC AdBot (Login to Remove)

 


#2 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:09:18 AM

Posted 12 November 2009 - 12:13 PM

Hi,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop. Post them back to your topic.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#3 Jtcmu

Jtcmu
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:18 AM

Posted 14 November 2009 - 09:46 PM

Thanks for the reply...here are the two logs:

Attached Files



#4 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:09:18 AM

Posted 15 November 2009 - 06:37 AM

Hello again Josh,

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  • Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.


A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#5 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:09:18 AM

Posted 21 November 2009 - 05:20 AM

Due to inactivity, this thread will now be closed. If you need this topic reopened, please contact a Staff member. Include the address of this thread in your request. This applies only to the original topic starter. Should you have a new issue, please start a New Topic.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#6 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:09:18 AM

Posted 23 November 2009 - 12:33 AM

Topic re-opened upon user's request.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#7 Jtcmu

Jtcmu
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:18 AM

Posted 24 November 2009 - 10:19 PM

Thanks for reopening the thread! I ran combofix and it fixed many of the problems I was having...but not all. For instance, whenever I searched on Yahoo! or Google I could see the search results, but any time I clicked on one of the results it redirected me to another page. Therefore, I ran Combofix again and Malwarebytes after that (the same day that I requested the thread to be reopened). This seems to have resolved the issues I was having as my computer seems to be working properly. Should I still post the combofix log?

#8 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:09:18 AM

Posted 25 November 2009 - 12:44 AM

Hi,

If you want to be sure that there's nothing bad left you could post c:\ComboFix.txt contents (don't run again but post the log you currently have there) and fresh dds log. Also, if you have MBAM report handy post that one too.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#9 Jtcmu

Jtcmu
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:18 AM

Posted 28 November 2009 - 10:32 PM

Here are the files that you requested. The Combofix file is dated, but the DDS files were just created. Everything is running smoothly, except it is a tad slow at startup.

Attached Files



#10 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:09:18 AM

Posted 29 November 2009 - 09:50 AM

Looks quite good. A few apps need updating though.

Everything is running smoothly, except it is a tad slow at startup.

Have you defragged hard drive lately?


Uninstall old Adobe Reader versions and get the latest one (9.2) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.


Uninstall your current Adobe shockwave player and get the fresh one here if needed.

Uninstall vulnerable Flash versions by following instructions here. Fresh version can be obtained here.


Uninstall these vulnerable Javas:
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2_03
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Java™ SE Runtime Environment 6 Update 1


Download ATF (Atribune Temp File) Cleanerę by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Reboot and post a fresh dds log.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#11 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:09:18 AM

Posted 06 December 2009 - 07:09 AM

Due to inactivity, this thread will now be closed. If you need this topic reopened, please contact a Staff member. Include the address of this thread in your request. This applies only to the original topic starter. Should you have a new issue, please start a New Topic.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users