[Resolved]Panda Found Virtumonde (additional Posting For 2nd Pc)

If its in red and locked than just proceed with the rest of the instructions

There is a button called Restore/Backup in black with a green arrow. When I click on this nothing happens. I clicked the "Make Hosts Writable?" changing it to an open lock reading "Make Read Only". After doing this I was able to get the the Create Backup option. Do I change the open lock "Make Read Only" back to the closed lock "Make Hosts Writable?" before I select Restore Microsoft's Host Files? Also I just noticed this is V 4. Is that okay?.

Also I just noticed this is V 4. Is that okay?.

Yes, I fell behind in my fixes

Do I change the open lock "Make Read Only" back to the closed lock "Make Hosts Writable?" before I select Restore Microsoft's Host Files?

NO , by making them writable malware will be able to change them.

How are things running now?

Definitely better both direct through broadband & wireless. Thanks a bundle for all your time & help. Any recommendations on where I can read about the host files being corrupted and how to avoid, in layman terms? Can I delete the zip files you had me down load throughout this? Thanks again, Denise

You can remove any of the programs I had you install as there are newer versions coming out all the time.

http://www.mvps.org/winhelp2002/hosts.htm



How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

• Tutorial for System Restore <– Do this first to prevent yourself from
  being reinfected.
• Tom Coyote
• TonyKlein CastleCops
• Grinler BleepingComputer
• Geeks To Go
• Dslreports

Here are some free programs to install, don't leave home without them

• Spybot Search and Destroy 1.4
  Check for Updates/ Immunize and run a Full System Scan on a regular basis.
  
• Ad-Aware 2007 7.0.1.5
  Check for Updates and run a Full System Scan on a regular basis.
  
• Spyware Blaster It will prevent most spyware from ever being installed.
  
• Spyware Guard It offers realtime protection from spyware installation attempts.
  
• Win Patrol This program will warn you when any changes are being made to your system and give
  you the option to deny the change.
  
• IE-Spyad
  IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads
  (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  
• Firefox 2.0 It has more features and is a lot more secure than IE. It is a very easy and
  painless download and install, it will no way interfere with IE, you can use them both.
  
• Zone Alarm Here is a free Firewall from Zone Labs, I
  wouldn't access the internet without it.

Safe Surfn
Ken

Hello Denise,

I was out the door when you replied , I didn't mean to cut you short. I will try to explain the Hosts file and why its so important. Your computer has the ability to convert IP addresses into words that as humans we can understand. This is called your (DNS) Domain name system. Basically what it does is ( as an example ) when you type www.ebay.com, the computer converts it to ebays IP address which is ([removed]), why, because when a friend asks you where you bought those nice looking new shoes, its a lot easier to say eBay instead of [removed]. So we set your hosts files correctly ( they were damaged - don't know why ) so when you type in amazon.com it will take you there. The problem is that some malware will change those settiing for there own good so that when you type in ebay.com, it will take you to any webpage that they want to direct you to by just changing the number in your hosts file for ebay to whatever they want. When we ran hoster, we corrected all that and also locked those files so they can't be changed.

If you look at the end of your Smitfraud log you will see your DNS Server is

68.80.0.0 - 68.87.255.255
Comcast Cable Communications, Inc.
1800 Bishops Gate Blvd
Mt Laurel, NJ
US

A Malware program can change that and direct you to anyplace on the Whole Wide Web they wanted to.

Hope this helps you understand it a little more.


Ken

Hi Ken, Not a problem at al. I appreciate all the time you did spend on this. Is there a scan I should run on a regular basis for corrupted host files? Thanks - Denise

No Denise,

But you will know if its ever out of whack , you will be redirected to other sites. hostsXpert is not something to use on a regular basis, just when you run into trouble.

Another option is to install Spybot Search and Destroy , follow the instructions , especially by installing Spybots Hosts files, this won't change your current hosts file, what it will do is to take 1000s of bad sites and add them to your Host Files with a IP address of 127.0.0.1 <– Which is your computer So if you enter one of those bad sites by mistake and it tries to add a cookie or a bad download it will take you to your computer to find it, when it can't ( because you redirected them away from there server ) it will give up and go away.

This is one of the better free programs on the web, I help with logs in there forum also.

Please download Spybot Search and Destroy 1.4

If you have the older version 1.3, remove it via the Add-Remove Programs in the Control Panel.

• During Installation, just follow all the defaults.
  
• Go to Mode and click on Advanced Mode
  
• Then to Updates Search for Updates
  
• If you get a Bad Checksum Error, just choose a different download location.
  
• Then to Settings/ File Sets and take the checkmark out of Usage Tracks
  
• Then to Tools/ Hosts Files click on Add Spybot S&D Hosts Files.
  
• Then to Tools/ IE Tweeks and put a checkmark in Lock the Hosts Files
  
• Then to Immunize. Up at the top by the GREEN SIGN, click on Immunize.
  
• Then to Search and Destroy/ Check for Problems
  
• Let it scan your system
  
• Then to Fix Problems and fix everything in Red
  
• Reboot your computer.

Have fun

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.