[Resolved] virtumonde virus?

accidentally clicked on CF before putting the CFScript file into it . (d'oh!) from your previous instructions it seems to be a very very bad idea to interfere with CF, so i let it run its course… during it's run a McAfee Virus Scan window popped up in the lower right corner (not sure why…i had exited from the program as i've done previously): "A Virus has been detected! The file C:/DOCUME~1\MICHAE~1\LOCALS~1\ Temp AV-test.txt is infected by the EICAR test file virus and cannot be cleaned. I want to… Delete the infected file quarantine the infected file find out more information continue what i was doing" after CF finished it's course, i clicked "continue what i was doing". A window popped up saying something like "A virus was detected, suggest you delete or quarrantine…continue what you were doing?" I clicked "no", then clicked "find out more information". A window popped up asking me to delete or quarrantine the file. i was able to close the window without selecting an option. I then checked the lower right hand corner (near the clock). as suspected, no mcafee M. i then dropped the text file into CF as i was supposed to have done the first time. the window didn't come back. however, CF rebooted the computer and a McAfee window popped up after the reboot: "McAfee SecurityCenter is currently installed. McAfee strongly recommends that you click "yes" to select McAfee SecurityCenter as our default SecurityCenter. If you click "No", McAfee SecurityCenter and Windows Security Center will be enabled, which might result in duplicate security status messaging." This has happened each time CF reboots the computer. I figured it was normal because McAfee had been disabled prior to the reboot. Didn't think it was weird until now. Each time I have waited for CF to finish, click ed"yes", then gone to the lower right and disabled McAfee. Hopefully this has been the correct option, and hopefully I didn't screw anything up by not mentioning it earlier. i saved the two CF logs…let me know if you want them okay…ran ATF as instructed. very quickly (2 seconds?) came back and said it had freed 6.512.000 KBs ran Mbam. that log, plus a HijackThis log, are attached how my computer is behaving at the moment…seems okay. my husband used the computer this evening (right before i kicked him out to start running your latest round of instructions) to update a spreadsheet. he commented that the computer seems much faster than it did a few days ago. please note that we are not using the internet with the "infected" computer. The infected computer has not been on the internet since before i posted here except for last night, this morning, and this evening (all while attempting to run the kaspersky scanner or get updates for Mbam). let me know if you want me to reboot and jump online to see how it's acting. thanks, kristin

kristin031204,

Believe it or not, Log looks good

You did very well. Very easy to help. Thanks.

I don't know what was going on between CF and McAfee but I guess I don't care because between CF and Mbam, the wicked virus is dead!


Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
• Note the space between the X and the U, it needs to be there.
• [external image: Posted Image]

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

Please re-enable any security that was disabled.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:

• From your desktop, right-click on My Computer,
• click on Properties
• Select the Automatic Updates tab
• Click on Automatic
• Click on Apply button
• Click on OK to exit.

If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol


Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.


Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

"I don't know what was going on between CF and McAfee but I guess I don't care because between CF and Mbam, the wicked virus is dead!"

ha ha!! me neither very happy to hear the virus is gone


okay…i read through your post. thanks for all the info, as i was going to ask how to better protect our pc in the future. one problem, tho (of course!) i typed in the line in the Run prompt two ways (one ComboFix /u and one Combofix /u). both ways say "Windows cannot find "ComboFix" Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search". I noticed the CF icon on my desktop no longer looks like that bad-ass cougar that ate my evil virus…it now looks like a standard icon for a program (white box, blue bar on top). also it now says "Shortcut to ComboFix". I ran a search for ComboFix. Results had the shortcut (located on the desktop) and 5 text files. no "ComboFix.exe"


no rush to get back to me on this…i have to hit the sack for the night.

thanks again,
kristin

kristin031204,

I think your McAfee really doesn't like CF.

Drag the wanna-be icon to the trash.

Find the folder C:\Qoobox and delete it.

You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

If you want your clock in 12 hr vs. 24 hour format:

• Click on Start
• Click on Control Panel
• Click on Regional and language options
• Click on customize
• Click on Time tab
• Click on arrow to the right of time format
• Select h:mm:ss tt
• OK your way out

Any more questions?

wish my mcafee was as tough on virtumonde as it is on ComboFix… the instructions make sense to me. i'm away from my home computer until this evening. i'll get back to you to let you know that everything worked out. thanks again for all of your help and patience!! -kristin

kristin031204, No problem.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.