#1
Member
Profile: Join Date: Aug 2008
Location: Chelmsford, Essex
Posts: 27
Computer Experience:
[Resolved] Detected Win32/Adware.Virtumonde and Win32/Privac
Hi everyone. I am new to this forum type communication, so please be gentle with me.
Didn't find the information you thought to find?Similar Threads
#2
Member
Profile: Join Date: Aug 2008
Location: Chelmsford, Essex
Posts: 27
Computer Experience:
Windows Warning Message - Detected Win32/Adware.Virtumonde and Win32/Priva
Hi.
#3
Inactive
Profile: Join Date: May 2008
Posts: 10
Computer Experience:
I use AVG 8 and it seems to be very good at removing trojans and malware. I think you should also run CCleaner system and registry cleaner. You can also run the full system scan at PCPitstop.
#4
Staff
Profile: Join Date: May 2002
Location: Staffordshire, UK
Posts: 21,698
Computer Experience:
Read this and post the logs requested in this thread.
#5
Member
Profile: Join Date: Aug 2008
Location: Chelmsford, Essex
Posts: 27
Computer Experience:
Hijack this log pasted to this message.
Thanks Pete,SP3 (WinNT 5.01.2600)http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://uk.red.clientapps.yahoo.com/c...o/bt_side.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/ https://www.mynortonaccount.com/amsweb/default.do http://security.symantec.com/sscv6/S...in/AvSniff.cab https://moneymanager.egg.com/Pinsafe...nttracking.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab
#6
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,548
Computer Experience:
Hi sjgfinancehere or here and save the file to your desktop.mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select 'Perform Quick Scan ', then click Scan .
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked , and click Remove Selected .
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Post the entire report in your next reply along with a fresh HijackThis log.
#7
Member
Profile: Join Date: Aug 2008
Location: Chelmsford, Essex
Posts: 27
Computer Experience:
Mbam & Hijack & combofix logs
Hi Geri,SP3 (WinNT 5.01.2600)http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://uk.red.clientapps.yahoo.com/c...o/bt_side.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/ https://www.mynortonaccount.com/amsweb/default.do http://security.symantec.com/sscv6/S...in/AvSniff.cab https://moneymanager.egg.com/Pinsafe...nttracking.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab FAT32 WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! js - STARTUP.HOMEPAGE - abouthttp://www.gmer.net
#8
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,548
Computer Experience:
HiPlease go to Jotti's malware scan
Copy and paste the following file path into *the *"File to upload & scan" box on the top of the page: one at a timeC:\WINDOWS\system32\zwtib.dll
Click on the submit button
Please post the results in your next reply.
contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
File::
C:\WINDOWS\tmp454671.bat
C:\Documents and Settings\All Users\Application Data\cjmhydmr
C:\WINDOWS\system32\ifulmtyh.exe
Folder::
C:\Program Files\jbgvhc
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sysgensmart"=- Please post the Jotti results and the combofix log.
#9
Member
Profile: Join Date: Aug 2008
Location: Chelmsford, Essex
Posts: 27
Computer Experience:
Jotti's malware scan
Hi Geri.FAT32 WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net SP3 (WinNT 5.01.2600)http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://uk.red.clientapps.yahoo.com/c...o/bt_side.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/ https://www.mynortonaccount.com/amsweb/default.do http://security.symantec.com/sscv6/S...in/AvSniff.cab https://moneymanager.egg.com/Pinsafe...nttracking.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab
Last edited by sjgfinance; 28th August 2008 at 11:17 .
Reason: Due to old age I forgot to paste combofix & HighjackThis logs.
#10
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,548
Computer Experience:
Hicontents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
File::
C:\WINDOWS\System32\zwtib.dll
Folder::
C:\Documents and Settings\All Users\Application Data\cjmhydmr
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"GlmWCGyfVAvE"=- Please re-open HiJackThis and scan only . Check the boxes next to all the entries listed below. O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe...nttracking.cab close all windows other than HiJackThis , then click Fix Checked. HJT .CF log and a new HJT log.
#11
Member
Profile: Join Date: Aug 2008
Posts: 2
Computer Experience:
Hello Steve,www.bleepingcomputer.com but it tells me "the web page cannot be displayed." I can't get into virus help sites. Please tell me what you did to fix your problem.
#12
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,548
Computer Experience:
Hi holdermb
#13
Member
Profile: Join Date: Aug 2008
Location: Chelmsford, Essex
Posts: 27
Computer Experience:
New CF & HJT logs after HijacjThis fix.
Thanks again Geri.CF Log .........FAT32 WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net HJT Log ..............SP3 (WinNT 5.01.2600)http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://uk.red.clientapps.yahoo.com/c...o/bt_side.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/ https://www.mynortonaccount.com/amsweb/default.do http://security.symantec.com/sscv6/S...in/AvSniff.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab
#14
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,548
Computer Experience:
Hi SteveHD Audio Data Rerouter.
#15
Member
Profile: Join Date: Aug 2008
Posts: 2
Computer Experience:
What is a CFScript?
Hi Geri,
Last edited by Geri; 28th August 2008 at 18:44 .
Reason: Jumped thread
All times are GMT +1. The time now is 20:39 .
Windows Warning Message - Detected Win32/Adware.Virtumonde and Win32/Priva
