TechSpot

Been wrestling with this: Virtumonde & sagipsul

By tlfromva
Jan 4, 2009
  1. I noticed something amiss when Security Center would not enable. Then, if I tried to go out to McAfee, Norton, or any other virus product site, my browser wouldn't go there. Other behavior made me suspicious. So, after hours of researching and working on the problem, I've found and followed the suggested 8-step program leading to the attached (combined) logfiles. Please note, all three logfiles are in the attached file.

    I don't know if I'm clean yet, but want somebody with a trained eye to tell me if things are back on track.

    Thanks in advance!

    (Oh, and I had some rootkit installed that was found and removed using Avenger. After that, other efforts began to uncover malware. )
     
  2. rf6647

    rf6647 TS Maniac Posts: 931

    Code:
    C:\WINDOWS\system32\[B]lgoxtu.dll [/B](Trojan.Vundo) -> Delete on reboot.
    
    MBAB did not handle all that it found until the computer restart.

    Rescan with MBAB & SAS (run as pairs) until clean or something that cannot be cleaned.

    HJT scan informs what has not been handled (computer restart before HJT scan)

    Caught by HJT.
    Code:
    O20 - AppInit_DLLs: …….[B] lgoxtu.dll[/B]
    It appears that the infection is mostly handled. Following clean scans establish a clean restore point.

    Establish a new clean restore point and Clear your existing System Restore points:
    • New
      • Go to Start > All Programs > Accessories > System Tools > System Restore>
      • Select Create a restore point> OK.
    • Clear Old
      • go to Start > Run > cleanmgr > Select the More options tab >
      • Choose the option to clean up System Restore > OK

        • This will remove all restore points except the new one you just created.
     
  3. tlfromva

    tlfromva TS Rookie Topic Starter

    Thanks!

    After reading this yesterday, I got two clean scans in a row and set a new restore point. Things look like they're operating pretty normally now. Thank you.

    Should I continue to keep SAS installed and running? I'm also running Spybot S&D as well as NOD32.
     
  4. rf6647

    rf6647 TS Maniac Posts: 931

    Code:
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    This application can be setup NOT to run on startup. As freeware this is how they advertise. As freeware it only cleans on demand.

    I scan with updated MBAB & SAS about once a month. So far they confirm my resident protections are working.

    I think it is very risky not to use a firewall. Your experiences may indicate it is not needed.

    I do not feel comfortable recommending particular applications.
     
  5. tlfromva

    tlfromva TS Rookie Topic Starter

    I firewall mostly at my router, actually. And recently fired up the one built in Windows.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.