[Resolved] Virtumonde and Rootkit Problem

Hello, this is my first time here, and I stumbled upon the place in search of help to fix my computer from two problems that Spyware Doctor continues to tell me I have, even after it says they are fixed and a reboot. As the topic says, these problems are 'Trojan.Virtumonde' and 'Rootkit.Agent'. The symptoms my computer is having are as follows: -While browsing in Mozilla Firefox, every few moments or minutes, an Internt Explorer pop-up appears. -Upon reboots, my computer will sometimes not boot at all, getting stuck at certain points, and lately has been saying that 'something' disc 0 and 1 cannot be found, press F1 to continue, F12 to go to 'someplace'. I press F1, and my computer continues to boot like normal. -After getting PC Tools Spyware Doctor, Mozilla Firefox sparks Spyware Doctor to tell me a malicious act was tried to be carried out, and a box came up saying something was wrong, but Firefox loaded anyway. -After trying to use VundoFix, the last problem doesn't occur, but also, Spyware Doctor doesn't show alerts anymore. -I cannot load HiJack This because it tells me there's a problem and that a worm has been carried on it or something. This started about five days ago with a command window opening on its own for a brief moment, and disappearing. I'm already paranoid of being hacked because of some e-drama on YouTube and some kids calling themselves Anonymous when they are not in fact Anonymous. All the same, I was worried one of them decided to hack into my computer. So, I decided to unplug my computer from the wall all together for a moment. I plugged it back in, booted the computer up, and hoped for the best. Unfortunately, I opened Mozilla Firefox and went to MySpace. A new tab opened without my doing so. I closed it immediately. Soon thereafter, an iexplorer pop-up appeared. I also closed that immediately. I became worried, unplugged my internet, and did an AVG scan. It came up with plenty of cookies, deleted them, and I hoped things would be fine. Until I went to sleep that night, the computer behaved fine. When I went to bed, I shut the computer off just in case. I wake up, boot it up (it booted fine at the time) and I am left with the various iexplorer pop-ups. This is my only problem at the time. I become annoyed, naturally, and do another AVG scan with the same results - okey-dokey until reboot. I try to install Norton (which my father had purchaced a while back, but I didn't really need or want it at the time, so I didn't install it) by sticking the CD in. The drive doesn't read it, and I try to eject the disk, but there is no response. I try to reboot the computer, but it lags and more or less freezes. So, I unplug the computer from the wall and immediately plug it back in. This is where I have major issues booting my computer. I have no idea what is going on and only see it saying certain discs are not found or something. I try to boot it again with simiar problems. I then unplug the computer again, use a safety pin to remove the CD, and open the CPU to see if the wires have come loose. I give them a wiggle, but that's all. I replace the casing and plug the computer back into the wall. It reboots fine. I begin searching for a fix and come across PC Tools Spyware Doctor. I use it, and it fixes all problems it finds with the exception of Virtumonde and Rootkit. Once I try rebooting with Spyware Doctor, my uploads continue to be strange either pausing at a certain spot (where the white bar loads… I don't know if this is with all computers, but I'm using a Dell, and I do not remember the word(s) above the bar, but this is where it freezes sometimes) or telling me some discs 0 and 1 cannot be found or loading them failed (again, I forget the exact wording). Spyware Doctor seems unable to delete these problems. I continue searching for a fix under these keywords and come across FSBL and VundoFix. FSBL resulted in nothing, and VundoFix found things and said they were fixed. I am still having troubles. Now I have come across this site and run across my last problem: I realize HiJackThis will be necessary to fix things with your help. However, when I went to go install it, the last or one of the last few pieces needed to be installed will say, "An error occured while trying to rename a file in the destination directory: MoveFile failed; code 5. Access denied." I am given the options of "Retry", "Abort", and "Ignore". "Retry" results in the same thing. "Abort" of course cancels the installation, and "Ignore" will trigger McAfee to come up and tell me a worm was on it and was removed. I believe I now have a problem with too many anti-virus programs and firewall issues. I'd also appreciate it that whoever is kind enough to help me give me VERY specific directions since I can be airheaded sometimes and be like, "HUH?!" to something that you may find quite obvious, like how to set firewalls or disable this and that. I really appreciate any and all help! Thanks!

Hello and Welcome to the forum.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Open the HijackThis Folder. Find the file HijackThis.exe, Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.

Post a new HijackThis Log.

Firstly, thank you for taking the time to help me! It's greatly appreciated.

Now, I did as you said up until renaming the HijackThis.exe file. I do not yet have this program on my computer, so I tried to download and install it again. While installing, I came up with this:

[external image: Posted Image]

I am unable to install the program, so I cannot give you a log. I apologize.

Did just as you said and I am still getting the error while trying to install HJT. Here is the RVAXO log, though (guess this is going to be tougher than we though, huh?):

—RVAXO.exe Updated: 2008-02-12—first run—
Files found:
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\bszip.dll

Uninstallers:


Folders Found:

C:\Program Files\MyWaySA
C:\WINDOWS\system32\nGpxx01
C:\Temp\1cb
C:\Temp\tn3

Hosts-file was reset, If you use a custom hosts file please replace it…

————–RVAXO.exe last run—————

Files found:

C:\WINDOWS\system32\drivers\core.cache.dsk
Folders Found:

————–RVAXO.exe finished—————-

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–

• Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
• WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
• Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Did as you said until I went to use ComboFix. It first told me that the version I had was outdated (it being the one you linked me to and I had not previously downloaded ComboFix). I tried redownloading it and when I tried to use it, it told me I cannot "rename Combo-Fix to ComboFix". I said, "What the…" to myself since I hadn't tried to change the name. It told me this twice while trying to use ComboFix two different times, and I then took the hyphon out of the name. It would load, but then nothing would happen for several minutes until I closed it. I tried downloading HijackThis anyway, and nothing has changed.

Try this one.
http://download.bleepingcomputer.com/sUBs/combofix.exe

I get a 404 not found error when clicking that link. EDIT: I restarted my computer to see if it would have any effect on Combofix, and I redownloaded it from post #6 of this thread. I opened it, it seemed to work fine, and it told me that this version had expired on January 30th, 2008 and that I need to download an updated version.

Try the one from here.
http://subs.geekstogo.com/ComboFix.exe

Well, this one seems to start to work, but not completely. Different things happen each time I try to run it. Most usually, I'll double click ComboFix.exe, the blue box will come up, but nothing will happen. Twice, the blue box came up, and it said that ComboFix is preparing to run, but that line disappeared and my box was empty again. Only one time did it gave me prompts saying not to use the program unsupervised, 1/100 computers fail after use, etc… After those prompts, A bar loaded, and I was again left with a blue screen with nothing appearing in it after several minutes. Am I being incredibly impatient with this program and things don't normally appear in the blue area while it works or is there something preventing it from working properly? No log was created and HijackThis still won't install properly.

It can take up to 20 minutes for the program to finish Give it some time.

I'm just worrying, though, if there should be text and things showing up in the blue part of the window while it works because except for the one time I ended up with my prompts, nothing will show up there beyond "ComboFix is starting up".

After leaving ComboFix up for an hour and nothing happening, I closed the program. I'm starting to think it may be easier to just reformat my C drive or system restore and then go from there to see if there are any remnants of the virus left. Let me know if you think this is a good idea. Also, since running ATF Cleaner, a couple of minor oddities have occured. One being while switching user names on YouTube, the saved usernames would not highlight when I hovered my mouse over them, and upon clicking them, the drop box disappeared without the name showing up in the username field. This only happened once, and my usernames and passwords still seem saved. The other thing is that my time in the bottom right was moved back an hour and switched to military time by itself. Let me know if you think reformating or system restoring is alright, and after I do so, I'll try downloading HijackThis again and see if we can go from there. Thanks.

You could try System Restore. 1. Click Start. 2. Point to All Programs. 3. Point to Accessories. 4. Point to System Tools. 5. Click System Restore. 6. Follow the instructions on the wizard. See if you can find a date the the PC worked.