TechSpot

Problem with Virtumonde

By xLOBO11x
Jan 24, 2009
  1. hey guys, i recently ran into the virtumonde trojan and had run avg and spybot with no avail. i got lucky and was pointed in this direction,read the 8 steps and followed through. haven't had problems so far.. here are my logs. also, would i have to keep all the programs downloaded in the 8 steps or is it ok to remove and if so which ones would be the best to keep? thank you so much again for all your help.

    -xlobo11x
     
  2. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    -> No action taken on MBAM scan, for found issues
    Please re-run Malwarebytes
    Confirm updated (third tab) Your Malwarebytes was not updated either
    Then do the above quoted message, but this time "Remove all found issues"

    By the way, you will need to then restart, and run (and attach) a new HJT log and Malwarebytes log


    Once Malwarebytes has been done, and all Malwares manually removed by you
    You could do this too.

    1. Download VundoFix; Trojan.Vundo Removal Tool; VirtumundoBeGone and ComboFix.
    2. Go Offline - pull the cable network, turn off wireless card, turn off your modem.
    3. Restart computer and press F8 to run Windows in Safe Mode
    4. Run VundoFix.. Click on the Scan for Vundo. Scanning will begin, which takes a long time. In the white box will display the names of infected files. After the scan is complete click Remove Vundo, removal will begin. Confirm by clicking Yes. The application should ask for permission to restart your computer - click Yes. Start Windows in Safe Mode again.
    5. Run FixVundo. Click Start, and then follow the instructions. It should be noted that this application can deal only with older mutations Vundo (Virtumonde).
    6. Run VirtumondoBeGone. Click Continue and wait for the report.
    7. Run ComboFix. Then, in the two windows that appear click Yes, and start scanning and removal of any Vundo (Virtumonde) infection. During this operation, you are not allowed to move the mouse or perform other actions. After the scan is complete, program will show a text file - a report from the program's action.
    8. Restart computer and run Windows normally.
    9. Attach the report
     
  3. xLOBO11x

    xLOBO11x TS Rookie Topic Starter

    almost there

    thank you for your quick reply kimsland, i really appreciate it. I followed your guide and got as far as step #7. when i try to run the combofix it will not let me saying it cannot name the file combofix, this is after the installation where i am given the run the application option... thats as far as i get with that... but here is the malaware and hijack reports so far... once again thank you
     
  4. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    oh, I haven't checked the logs yet
    But with Combofix, as you select download, rename Combofix (still in the save as box) to Combo-Fix, or any name you like, ie just rename it to CF

    Then try running it
    You can also run it in Normal mode, but if you have screen savers and Power Management and Tasks going on, it can interfere with it

    Ok, just checked the logs, and what a log :D

    Please run HJT Scan and tick all of the following, then select Fix all
    Make sure any\all Internet Browsers are closed first
     
  5. xLOBO11x

    xLOBO11x TS Rookie Topic Starter

    followed your instructions, everything was smooth. i re-did step 3 before rescanning things just in case, dunno if i had to but figured why not, here are the logs from that, once again thank you very much.

    ps. do you recommend i keep all the programs downloaded?
     
  6. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    No, we will remove all those programs later

    Vongo is still starting with Windows
    We need to stop it from running then remove it

    KillBox is a tool to delete in-use files, if the file is running, KillBox will attempt to end the process (close the running file) and delete it.

    Download KillBox: http://www.killbox.net/downloads/KillBox.exe
    Run it, and copy and paste this line into the path: C:\Program Files\Vongo\Tray.exe
    Click the Red X (delete button)

    Restart back to SafeMode
    Locate: C:\Program Files\Vongo folder and delete it

    Startup HJT scan still in Safe Mode
    Tick and fix the following entries:
    Restart back to Normal mode
    Provide another HJT scan log (I want to see if it's now removed ;) )
     
  7. xLOBO11x

    xLOBO11x TS Rookie Topic Starter

    i followed your instructions..C:\Program Files\Vongo\Tray.exe and C:\Program Files\Vongo supposedly did not exist... i went through it manually and deleted all these... the nly thing left is the vongo in the add/remove programs which won't let me delete it because its in 'safemode'(but it won't show on normal mode) and/or because the installer is not 'correctly installed'. thank you very much and here is my log
     
  8. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    I'm a bit confused about your log, it seems incomplete

    Uninstall Symantec (Norton) Antivirus
    Run the Norton Removal tool

    Install Avira free AntiVirus

    And run a full scan
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...