#1
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
[Resolved] Virtumonde back after Fdisk reinstall
I just Fdisked my C drive yesterday and did a fresh install of XP Pro. I seem to have downloaded or ran the wrong program. I now infected again. Spybot S&D is now showing both virtumonde.dll and virtumonde.prx. Any help would be greatly appriciated. Automatic Updates will no longer start either.PCI \VEN_11AB&DEV_4362&SUBSYS_81421043&REV_20\4&8D68EE5&0&00E4PCI -E Gigabit Ethernet ControllerPCI \VEN_11AB&DEV_4362&SUBSYS_81421043&REV_20\4&8D68EE5&0&00E4www.Snowbnd.com); SnowBound RasterMaster for NT/W2000>HD Audio Hide windows program>
Didn't find the information you thought to find?Similar Threads
#2
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
cont
Settings\Default User\NTUSER.DATwins dhcp www.007guard.com www.008k.com www.00hq.com www.032439.com
#3
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Welcome to WindowsBBS JohnnyQuad SP1 , please do so now, else any attempt at cleaning would be in vain. You would/could become infected again within minutes of connecting to the internet. Please do not install any other Service Packs until we get you cleaned up.here , saving the file to your desktop.this link for your applicable programs.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#4
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
ComboFix 08-07-24.1 - John 2008-07-24 19:21:05.1 - NTFSx86WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! ftp .exe"=TCP "= 3724:TCP :Blizzard Downloader: 3724PCI II (Encoder);C:\WINDOWS\system32\DRIVERS\hcwPVRP2.sys [2005-09-14 18:01]http://www.gmer.net
#5
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
Deckard's System Scanner v20071014.68SP3 (WinNT 5.01.2600)dss .exehttp://my.msn.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.update.microsoft.com/wind...?1216852594432 http://www.update.microsoft.com/micr...?1216877463531 http://dl8-cdn-01.sun.com/s/ESD44/JS...ws-i586-jc.cab http://www.trendsecure.com/easy_inst...syInstallX.CAB http://fpdownload2.macromedia.com/ge...sh/swflash.cab www.Snowbnd.com); SnowBound RasterMaster for NT/W2000>HD Audio Hide windows program>
#6
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
Fileswins dhcp
#7
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Please upload the following file to my submission channel for analysis. Leave a link back to this topic.
#8
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
while I was waiting for your initial reply I downloaded and ran Malwarebytes Anti-Malware program. It found and seems to have elimitated 51 problems. The system seems to be running better and I am now able to start Automatic Updates again. I also ran a scan on Kaspersky.com, it found no problems. I do however see a (no name) on this latest HijackThis report. Please let me know what I should do next. Thanks in advance.
#9
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Quote:
I just Fdisked my C drive yesterday and did a fresh install of XP Pro. I seem to have downloaded or ran the wrong program. I now infected again.
For the record, that wrong program might well be the P2P program BitTorrent. I'm not passing judgment on file-sharing as a concept. However, I will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page here , here and here .cpu cycles and bandwidth. This could be a major contributor to system slowdown.
#10
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
Malwarebytes' Anti-Malware 1.23
#11
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
The file you asked for has been uploaded. Here is the 2nd scan from MBAM
#12
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Looks like you're all cleaned up. ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined (rogue registry items removed). This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.ATF Cleaner by Atribune and save it to your Desktop.Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of: Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
Recycle bin
The rest are optional - if you want it to remove everything check "Select All".
Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.
Reboot An ounce of prevention is worth a pound of cure
#13
Inactive
Profile: Join Date: Jul 2008
Posts: 9
Computer Experience:
Everything seems to be fine now. I am recommending Malwarebytes to everyone I know. That program rocks. Thanks for all the help.
All times are GMT +1. The time now is 23:07 .
