#1
Member
Lifetime Subscription
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
[Resolved] Another Virtumonde victim who needs help
I have read many posts regarding this virus and have been given a small ray of hope by seeing the many [RESOLVED] precursors in the titles.SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ig?hl=en http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1177939433945 http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://www.shockwave.com/content/chu...loader_v10.cab
Didn't find the information you thought to find?Similar Threads
#2
Staff
Lifetime Subscription
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 3,848
Computer Experience:
Hi Nokandahere or here and save the file to your desktop.mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select 'Perform Quick Scan ', then click Scan .
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked , and click Remove Selected .
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Post the entire report in your next reply along with a fresh HijackThis log. Now do this. Download RSIT by random/random and save it to your desktop.
Double click RSIT.exe to start the tool and click Continue at the disclaimer.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Please post the contents of both logs here in your next reply.
#3
Member
Lifetime Subscription
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
Thanks so much for your quick response Geri. I feel like I know you after seeing your name attached to so many posts. SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ig?hl=en http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1177939433945 http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
#4
Member
Lifetime Subscription
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
Now the info.txt log:SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}JS ;.JSE;.WSF;.WSH
#5
Member
Lifetime Subscription
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
and finally the log.txt log:RAM : 767 MB (55% free)SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ig?hl=en http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1177939433945 http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab HD ---- C:\$AVG8.VAULT$
#6
Staff
Lifetime Subscription
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 3,848
Computer Experience:
Hi NokandaP2P software ( Limewire, BitTorrent uTorrent etc… ) We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page here , here and here .I would strongly recommend that you uninstall them, Note: Ok we need some files scanned. Please go to Jotti's malware scan
Copy and paste the following file path into *the *"File to upload & scan" box on the top of the page: one at a time C:\Documents and Settings\Pam\ppxcs.exe
Click on the submit button
Please post the results in your next reply.
Now please do this. Here disable realtime protection applications as they sometimes interfere with the tool. this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouseclick combofix's window while its running. That may cause it to stall Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.
isabled
pxcs"