[Resolved] Virtumonde Virus

tonym209,

It is very important to complete the steps in the exact order as they are given.

Also, please provide the logs requested as this is the only way for me to determine what neeeds to be fixed.
If the log doesn't exist or wasn't created please let me know this also.

- - - - - Next - - - - -

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quote box below into it:

File::
c:\windows\system32\gojajado.dll.zip
c:\windows\system32\gojajado.dll.tmp
c:\windows\isRS-000.tmp
c:\windows\system32\BIT1E4.tmp
c:\windows\system32\BIT1E5.tmp
c:\windows\system32\xa.tmp
c:\windows\system32\gehudehe.dll
c:\windows\system32\davafuhu.dll
c:\windows\system32\rotirufe.dll
c:\windows\system32\joseloho.dll
c:\windows\system32\feboyonu.dll
c:\windows\system32\yekenize.dll
c:\windows\system32\nudewolu.dll
c:\windows\system32\munuropi.dll
c:\windows\system32\hebebubo.dll
c:\windows\system32\mirupuho.dll
c:\windows\system32\dukemido.dl
c:\windows\system32\ronigofu.dll
c:\windows\system32\losiluso.dll
c:\windows\system32\betifupu.dll
c:\windows\system32\dogubina.dll
c:\windows\system32\firovopa.dll
c:\windows\system32\vopugoke.dll
c:\windows\system32\banewelu.dll
c:\windows\system32\bonipola.dll
c:\windows\system32\dezifamu.dll
c:\windows\system32\jatipife.dll
c:\windows\system32\ripagupa.dll

Folder::
c:\documents and settings\All Users\Application Data\17866404
C:\Program Files\Viewpoint\

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8fc99202-224f-4666-b16f-805fd53dc23a}]
[-HKEY_CLASSES_ROOT\CLSID\{8fc99202-224f-4666-b16f-805fd53dc23a}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5366673-E8CA-11D3-9CD9-0090271D075B}]
[-HKEY_CLASSES_ROOT\CLSID\{A5366673-E8CA-11D3-9CD9-0090271D075B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7"=-
[-HKEY_CLASSES_ROOT\CLSID\{71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPM2f592ec1"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"netivuwuwe"=-
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"netivuwuwe"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B8111CD6-49A3-4B0F-9F01-0041CEC2DCDB}]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FD7EEB46-63C8-4CAE-90E0-E012BF0A99F2}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppinitDLLs"=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\ShellServiceObjectDelayLoad]
"EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4"=-
[-HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}]
[-HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4"=-
[-HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4}]
[-HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4}\InProcServer32]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

- - - - - Next - - - - -

Reboot

- - - - - Next - - - - -

Please re-run DDS

• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

- - - - - Next - - - - -

On your next post please provide the following:

• ComboFix.txt
• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

The virus and all the malware and hacks are completely gone, I don't know how, I didn't even do the last step you posted, they're just gone, speed is back to normal, no popups no nothing. Thanks for the help.

tonym209,

I'm glad your computer seems to be running better.
Please follow the instructions below to clean up some of the tools we used and to help protect yourself from future infections.

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
• Note the space between the X and the U, it needs to be there.

[external image: Posted Image]

The above procedure will:

• Implement some cleanup procedures.
• Reset System Restore.

- - - - - Next - - - - -

You can delete the tools we downloaded: (both should be located on your desktop)

• DDS
• GMER
• RootRepeal

- - - - - Next - - - - -

Your Adobe Reader is out of date.
Please go to http://get.adobe.com/reader/ and download Adobe Reader 9
follow the instructions to install Adobe Reader.

- - - - - Next - - - - -

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

- - - - - Next - - - - -

Here comes the "All Clean Speech":

You need to set a new clean System Restore Point

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points
We need to set a new system restore point:

Click Start > Run > copy and paste the following into the run box:

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next.
Name it (something you'll remember) and click Create,
when the confirmation screen shows the restore point has been created click Close.

- - - - - Next - - - - -

Now remove all previous Restore Points:

Click Start > Run > copy and paste the following into the run box:

cleanmgr

At the top, click on More Options tab. Click the Clean up button in the System Restore box.
Click on the Yes button.
When finished, click on Cancel button to exit.

- - - - - Next - - - - -

Here are some tips to reduce the potential for spyware infection in the future:

Automatic Updates:

The easiest way to ensure you don't miss any of the critical Windows Updates is to set your computer up to receive Automatic Updates.
To set your computer up for Automatic Updates please do the following:

• Click Start, and then click Control Panel.
• Depending on which Control Panel view you use, Classic or Category, do one of the following:
• Click System, and then click the Automatic Updates tab.
• Click Performance and Maintenance, click System, and then click the Automatic Updates tab.
• Select Automatic and choose a frequency and time that's convenient for you to get the updates.
• Click Apply, then OK
• Close the Control Panel.

- - - - - Next - - - - -

Make your Internet Explorer more secure - This can be done by following these simple instructions:

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab.
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

You are using Webroot Internet Security as your anti virus software. It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

You are using Webroot Internet Security. I cannot stress how important it is that you keep the Firewall on your computer active at all times. Without a firewall your computer is susceptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly. For a tutorial on Firewalls and a listing of some available ones see the link below:
Understanding and Using Firewalls

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs. A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

Update all security programs regularly - Make sure you update all the programs regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Remember to have only one (1) Firewall and one (1) Anti-Virus program running at any one time.

I would also suggest you read "So how did I get infected in the first place"?: by Tony Klein

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.