#1
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
[Resolved] Another Virtumonde victim who needs help
I have read many posts regarding this virus and have been given a small ray of hope by seeing the many [RESOLVED] precursors in the titles.SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ig?hl=en http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1177939433945 http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://www.shockwave.com/content/chu...loader_v10.cab
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi Nokandahere or here and save the file to your desktop.mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select 'Perform Quick Scan ', then click Scan .
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked , and click Remove Selected .
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Post the entire report in your next reply along with a fresh HijackThis log. Now do this. Download RSIT by random/random and save it to your desktop.
Double click RSIT.exe to start the tool and click Continue at the disclaimer.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Please post the contents of both logs here in your next reply.
#3
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
Thanks so much for your quick response Geri. I feel like I know you after seeing your name attached to so many posts. SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ig?hl=en http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1177939433945 http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
#4
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
Now the info.txt log:SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}JS ;.JSE;.WSF;.WSH
#5
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
and finally the log.txt log:RAM : 767 MB (55% free)SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ig?hl=en http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1177939433945 http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab HD ---- C:\$AVG8.VAULT$
#6
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi NokandaP2P software ( Limewire, BitTorrent uTorrent etc… ) We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page here , here and here .I would strongly recommend that you uninstall them, Note: Ok we need some files scanned. Please go to Jotti's malware scan
Copy and paste the following file path into *the *"File to upload & scan" box on the top of the page: one at a time C:\Documents and Settings\Pam\ppxcs.exe
Click on the submit button
Please post the results in your next reply.
Now please do this. Here disable realtime protection applications as they sometimes interfere with the tool. this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouseclick combofix's window while its running. That may cause it to stall Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.
#7
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
Hi Geri. Yes, I know about the P2P programs. I got this computer system used and Shareaza, Bearshare, and Limewire were already installed on it. I did do an uninstall the first week I had the system and the programs are no longer on the start menu. The folders were deleted manually long ago since the uninstall did not do that. I was surprised myself to see them show up in the log files. I guess the uninstall didn't remove everything.
Last edited by Nokanda; 31st August 2008 at 03:47 .
Reason: clarification
#8
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
Ok for a while I thought combofix was stuck but I left it alone and it finally finished. Here is the combofix log:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=js - STARTUP.HOMEPAGE - hxxp://www.google.com/ighttp://www.gmer.net 0 0"0 0"
#9
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
HiCF log, so please run RSIT.exe again and post the log.txt log.
#10
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
Thanks Geri, here it is:RAM : 767 MB (56% free)SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ig?hl=en http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1177939433945 http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab HD ---- C:\$AVG8.VAULT$
#11
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi Nokandacontents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
File::
C:\WINDOWS\system32\drivers\av1fj8p7.sys
Driver::
av1fj8p7 Please post the combofix log and a new log.txt from RSIT.
#12
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
Hi Geri. Once again, thank you so much for all your help with this.WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net 0 0"0 0"
#13
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
and here is the RSIT log:RAM : 767 MB (55% free)SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ig?hl=en http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB http://upload.facebook.com/controls/...toUploader.cab http://update.microsoft.com/windowsu...?1177939433945 http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab HD ---- C:\$AVG8.VAULT$
#14
Member
Profile: Join Date: Aug 2008
Location: Toronto, Canada
Posts: 49
Computer Experience:
My system is working much better the last couple of days, not so slow except during boot up. Firefox still crashes though so I may have to uninstall and reinstall it once this is all over since I'm not a big fan of exporer. I do so much appreciate all the help you've given.
#15
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
KillAll::
File::
C:\WINDOWS\system32\drivers\adkor0q0.sys
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job
Driver::
adkor0q0 Reboot into safe mode. Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPost the contents of that log and another RSIT Log.txt Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
All times are GMT +1. The time now is 01:33 .
isabled
pxcs"
