Virtumonde/Fraud bug may have messed up my computer?

The past two days, I have been attacked by a viral attempt due to one particular site that was usually harmless to my computer in the past. My internet would slow drastically and i was forced to restart my computer. At those times i could not scan with Malwarebytes because it was "not found" and so I had to re-download it.

Just hours ago, I faced a situation in which I scanned with Spybot and found two Virtumonde viruses and a Fraud virus, which I quickly deleted.
Then, going on Google, I was attacked by a new window filled with pop-ups. I use Firefox and I never had this happen to me before. There were literally 3-24 tabs of spam and advertisements in just one click of a Google link.

This doesn't occur only in Google...it comes out in other harmless sites too, like Youtube and such...

Is this the result of the Virtumonde/Fraud virus? If it is just an internet security problem, how can I improve my security?

Edited by Armie Kim, 12 November 2009 - 09:09 PM.

It possibly is Vundo family.
Please download Rkill by Grinler and save it to your desktop.Link 2
Link 3
Link 4

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista, right-click on it and Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• If the tool does not run from any of the links provided, please let me know.

You will need to run the application again if reboot the computeralong the way.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Next run ATF and SAS:
Note.. SAS doesn't open the registry hives for other user accounts on the system, so scans should be done from each user account.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.

I was able to do everything up until the Safe mode part.
My computer (Windows XP Professional) was unable to boot into Safe mode. Everytime I chose the Safe mode option, it just returns to the black startup screen and says an apology. I tried all Safe mode options, but none worked...
Is this also because of a virus?

Here is my Malwarebytes scan: (it found nothing)
Malwarebytes' Anti-Malware 1.41
Database version: 3164
Windows 5.1.2600 Service Pack 3

11/13/2009 4:09:04 PM
mbam-log-2009-11-13 (16-09-03).txt

Scan type: Quick Scan
Objects scanned: 112123
Time elapsed: 7 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Please run SUper an d ATF in normal..

Also run part 1 of S!Ri's SmitfraudFix

Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

here is the Smitfraud report:

SmitFraudFix v2.424

Scan done at 18:25:01.50, 11/13/2009 Fri
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESTsoft\ALYac\AYServiceNt.aye
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ESTsoft\ALYac\AYAgent.aye
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\conime.exe

뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 hosts


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\WINDOWS


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\WINDOWS\system


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\WINDOWS\Web


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\WINDOWS\system32


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\WINDOWS\system32\LogFiles


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\Documents and Settings\owner


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\DOCUME~1\owner\LOCALS~1\Temp


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\Documents and Settings\owner\Application Data


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Start Menu


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Desktop


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 C:\Program Files


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Corrupted keys


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=dword:00000001


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 DNS

Description: Realtek RTL8169/8110 Family Gigabit Ethernet NIC - Packet Scheduler Miniport
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{55619619-6F3C-4883-B58C-B48F7857DC0C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{55619619-6F3C-4883-B58C-B48F7857DC0C}: DhcpNameServer=24.29.103.15 24.29.103.16
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.29.103.15 24.29.103.16


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 Scanning for wininet.dll infection


뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣뻣 End

Hi, please run Part Cleaner. Post this log and the SUperantispayware log. Tell me how it is running now.

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

Once in Safe Mode, double-click SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

I am still unable to go into Safe Mode on my computer. Everytime I choose the Safe Mode option, my computer just starts up to the black screen, and then says that it is sorry but is unable to go into Safe Mode.
I scanned with SUPERAntiSpyware, but it found nothing. Malwarebytes also detected nothing. Only Spybot seemed to pick up a Microsoft Firewall Bypass bug.

I also found out that I am now constantly bombarded mainly by a single site, advertising American Satellite. This comes up in a new tab in my Firefox window and pops up at any time.
Additionally, my computer unexpectedly shut down on me about an hour ago. When it restarted, another one of my antivirus programs caught a Trojan generic bug.

Hi,soory for the delay but stuff happens. It appears that some malware is still herand being protected by perhaps a driver or service and it is also causing the Safe Mode issue, Usually when safe mode fails I recommend a reformat and that still may be the case. other than that we wiill need to have the HJT team look deeper inside. So you will need to run HJT/DDS.
Please follow this guide. go and do steps 6 thru 8 ,, Preparation Guide For Use Before Using Hijackthis. Then go here HijackThis Logs and Virus/Trojan/Spyware/Malware Removal ,click New Topic,give it a relevant Title and post that complete log.

Let me know if it went OK.