[Resolved] Virtumonde and other Trojans

"NO ZoneAlarm LSP's have been detected on your computer" maybe I renoved them on the un-install

"NO ZoneAlarm LSP's have been detected on your computer"

maybe I renoved them on the un-install

I'm sure it did.
Are you connected to a router / hub?

router i'll try direct connect

router
i'll try direct connect

direct connect did not work, even with reboot

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
SpybotSD <–You can re-install when we're finished



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Reboot and see what happens.

is this is how you eliminate items from running in the background? task executed as instructed rebooted still no net connection my netgear router sees my pc, at least the light is lit

I have Restore pts the since 1/1/08

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe was not there

Use system restore and lets see if we can get it back. Is the 1/1/08 before you noticed the infection?

I'll be restoring w/ virus/trojan id'd problem 12/24

I'll be restoring w/ virus/trojan id'd problem 12/24

I guess we don'thave much choice.
This is what I'd do.

1. Run system restore and if it connects to the internet after that, unplug the internet connection.

2. Run Combofix and post the log from your other working pc.

no Restore available XP restore tried 3 times XP says no changes made

no Restore available XP restore tried 3 times
XP says no changes made

Different dates?

1/2 1/1 12/31 before that I did not have restore pts activated