Solved Virtumonde.sdn can't remove

[Broni]

Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
Click on View > Select Colunms.
In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.
Go File>Save As, and save the report as Procexp.txt.
Attach the file to your next reply.

====================================================================

This time, you can attach logs created by running the following...

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\JILLIP~1\AppData\Local\Temp\catchme.sys -- (catchme)
  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab  (Reg Error: Key error.)
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553557800} http://fpdownload2.macromedia.com/ge...sh/swflash.cab  (Reg Error: Key error.)
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
  O16 - DPF: Garmin Communicator Plug-In https://my.garmin.com/static/m/cab/2...nAxControl.CAB (Reg Error: Key error.)
  O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
  @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:56F368C9
  @Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:FACB65E7
  
  :Services
  
  :Reg
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [resethosts]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

 

[jlc]

Here is the process explorer report. I'll be on to the next part. I have attached it. Let me know if that is a problem.

 

[Broni]

It looks like this is your issue:

WksCal.exe 4112 48.85 [% of CPU] 1,688 K 27,692 K Microsoft® Works Calendar Microsoft® Corporation C:\Program Files\Common Files\microsoft shared\Works Shared\WksCal.exe /SCAN

Try to disable it in "msconfig", restart computer and see how it goes.

But, give me OTL logs first.

 

[jlc]

I've noticed that but haven't had any luck getting rid of it. The otl scan is still running. I'll be sure to do that next. I may have to send it to you tomorrow. I am on the east coast and have an early morning tomorrow. I really appreciate all of your help. I know a bit about computers but almost all of this is greek to me. Do you think the virtumonde.sdn is gone or is it still to early to tell?

 

[Broni]

Do you think the virtumonde.sdn is gone or is it still to early to tell?

You should be pretty much OK.
We'll run one more scan later, whenever you'll be ready.

 

[jlc]

Thanks again! The otl scan just finished. I'll attach the log once the computer reboots.

 

[Broni]

Cool .............

 

[jlc]

otl log
All processes killed
========== OTL ==========
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\Users\JILLIP~1\AppData\Local\Temp\catchme.sys not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {D27CDB6E-AE6D-11CF-96B8-444553557800}
C:\Windows\Downloaded Program Files\CONFLICT.1\swflash.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553557800}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553557800}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553557800}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553557800}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Starting removal of ActiveX control Garmin Communicator Plug-In
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Garmin Communicator Plug-In\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
ADS C:\ProgramData\TEMP:56F368C9 deleted successfully.
ADS C:\ProgramData\TEMP:FACB65E7 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Chris
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 18359157 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 1813 bytes

User: Chris Shuffle
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Cody
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: IPOD touch
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Jill
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Jill iphone
->Temp folder emptied: 4286003 bytes
->Temporary Internet Files folder emptied: 328085598 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 86769 bytes

User: Old Ipod
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 12629465 bytes
->Flash cache emptied: 676 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Sammy
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41044 bytes

User: Zachary
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 9813817 bytes
->Flash cache emptied: 41478 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7098 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 356.00 mb


[EMPTYFLASH]

User: All Users

User: Chris
->Flash cache emptied: 0 bytes

User: Chris Shuffle
->Flash cache emptied: 0 bytes

User: Cody
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: IPOD touch
->Flash cache emptied: 0 bytes

User: Jill
->Flash cache emptied: 0 bytes

User: Jill iphone
->Flash cache emptied: 0 bytes

User: Old Ipod
->Flash cache emptied: 0 bytes

User: Public

User: Sammy
->Flash cache emptied: 0 bytes

User: Zachary
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.9.0 log created on 07142010_224714

Files\Folders moved on Reboot...
File\Folder C:\Users\Jill iphone\AppData\Local\Temp\~DF69D6.tmp not found!
File\Folder C:\Users\Jill iphone\AppData\Local\Temp\~DF6A14.tmp not found!
File\Folder C:\Users\Jill iphone\AppData\Local\Temp\~DF6B8A.tmp not found!
File\Folder C:\Users\Jill iphone\AppData\Local\Temp\~DF79D1.tmp not found!
File\Folder C:\Users\Jill iphone\AppData\Local\Temp\~DF7C51.tmp not found!
File\Folder C:\Users\Jill iphone\AppData\Local\Temp\~DF8646.tmp not found!
C:\Users\Jill iphone\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ONX30YWZ\adsCAXO1FH0.htm moved successfully.
C:\Users\Jill iphone\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MNKNAUW5\sh20[1].html moved successfully.
C:\Users\Jill iphone\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MNKNAUW5\topic149897-2[1].html moved successfully.
C:\Users\Jill iphone\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H130QLL3\adsCAGCH5UC.htm moved successfully.
C:\Users\Jill iphone\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

 

[Broni]

Since you're ready for bed, this is your homework for...whenever

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.


2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

• Spyware, Adware, Dialers, and other potentially dangerous programs
  [*] Archives
  [*] Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

 

[jlc]

Thanks! I appreciate the homework. The otl quick scan is running now! I'll be sure to post once my homework is complete.
Thanks again! Enjoy your evening!

 

[Broni]

You're very welcome
Don't forget to check on that Works Calendar in "msconfig".

 

[jlc]

Here is the latest otl log. I've attached it since it was fairly large.

 

[Broni]

You're good

 

[jlc]

Yeah!!!!
I tried to disable the ms works wkscal.exe. I'm not sure if it worked or not.

I'm on to my homework now : ).
Thanks again!
Jill

 

[Broni]

I thought, you're going to bed...LOL
Kaspersky will take a while...

I'm not sure if it worked or not.

Re-run Process Explorer and check.

 

[jlc]

Thanks again! I keep planning on heading to bed, but like making progress : ).

 

[Broni]

LOL...........

 

[jlc]

I've attached the process explorer log after I stopped the wkscal.

 

[jlc]

Hi, I used the Kapersky link you sent, but the homework is not going well. I am unable to get the scan to run. I keep getting a message that "Launch of the Java application is interrupted! Please establish and uninterrupted internet connection for work with this program." I don't know how to do that. I thought I disabled avast and windows defender.
Thanks again!

 

[Broni]

CPU usage looks perfect

Instead of Kaspersky....

Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
• Tick the box next to YES, I accept the Terms of Use
• Click Start
• Accept any security warnings from your browser.
• Check Scan archives
• Click Start
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push List of found threats
• Push Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

 

[jlc]

Thanks! I'll post the list after it's run!

 

[Broni]

OK ................

 

[jlc]

virtumonde.sdn can't remove-ESET Scan

Hi,
I've attached the file from ESET. It found one item.
Let me know what's next : ).
Thanks again!

 

[Broni]

Wonderful

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

===================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista and 7:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

 

[jlc]

Yeah!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
My computer is doing much better. I have one other unrelated question. Whenever I log on I get an error message that "This driver is blocked due to compatibility issues. Driver Starforce Protection - Publisher Star Force - Location - Not Available.

Do you have any suggestions for getting rid of this? I'm not sure where it came from.
THanks again!