Results 1 to 4 of 4

Thread: Need help to remove virtumonde!!!

  1. #1
    Junior Member
    Join Date
    Sep 2007
    Posts
    2

    Default Need help to remove virtumonde!!!

    Here is Kasperskys results -

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Monday, September 10, 2007 7:03:44 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.93.1
    Kaspersky Anti-Virus database last update: 10/09/2007
    Kaspersky Anti-Virus database records: 411995
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - Critical Areas:
    C:\WINDOWS
    C:\DOCUME~1\JOSH'S~1\LOCALS~1\Temp\

    Scan Statistics:
    Total number of scanned objects: 27226
    Number of viruses found: 8
    Number of infected objects: 46
    Number of suspicious objects: 0
    Duration of the scan process: 00:41:43

    Infected Object Name / Virus Name / Last Action
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{C20487A8-278E-4572-8618-ECF1E8753668}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\aregkwxi.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\axuvtulg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\ddcbaya.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ha skipped
    C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
    C:\WINDOWS\system32\EsFw32.BIN Object is locked skipped
    C:\WINDOWS\system32\fesklqla.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\fomkciql.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\hervwxbu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\iclxnbbt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\ilmuslti.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\inkkdobn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\ivlbrjnn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\jyhgpphh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\jyniqilb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\kfkvonsn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\kqokyolh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\lbnyubwt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\lhfvlhxw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\llynvsar.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
    C:\WINDOWS\system32\mcbvacdj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\nykpoqvk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\oncymfwu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\pfkcftab.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\pjshvpja.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\pmnnn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fl skipped
    C:\WINDOWS\system32\pmnooop.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\WINDOWS\system32\pqlpvooq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\qgfjycqy.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\qkmnqtdn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\rxccghcs.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
    C:\WINDOWS\system32\spxyjdyg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
    C:\WINDOWS\system32\sshmhgav.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\ssqppml.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\WINDOWS\system32\svvulfqm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
    C:\WINDOWS\system32\taxnyukg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\tvtywsrg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\uvoqjshw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
    C:\WINDOWS\system32\vambpidc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
    C:\WINDOWS\system32\vxfwgijw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\javapi\v1.0\file\Counter.class-70f1ccc2-7b7c9cdd.class Infected: Trojan.Java.ClassLoader.i skipped
    C:\WINDOWS\Temp\javapi\v1.0\jar\box.jar-735820d6-357b568f.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
    C:\WINDOWS\Temp\javapi\v1.0\jar\box.jar-735820d6-357b568f.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
    C:\WINDOWS\Temp\javapi\v1.0\jar\box.jar-735820d6-357b568f.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
    C:\WINDOWS\Temp\javapi\v1.0\jar\box.jar-735820d6-357b568f.zip ZIP: infected - 3 skipped
    C:\WINDOWS\Temp\javapi\v1.0\jar\java-4939ee73-226d8e1a.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ap skipped
    C:\WINDOWS\Temp\javapi\v1.0\jar\java-4939ee73-226d8e1a.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ap skipped
    C:\WINDOWS\Temp\javapi\v1.0\jar\java-4939ee73-226d8e1a.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ap skipped
    C:\WINDOWS\Temp\javapi\v1.0\jar\java-4939ee73-226d8e1a.zip ZIP: infected - 3 skipped
    C:\WINDOWS\Temp\Perflib_Perfdata_cf4.dat Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    C:\DOCUME~1\JOSH'S~1\LOCALS~1\Temp\Perflib_Perfdata_248.dat Object is locked skipped

    Scan process completed.

    How much of the spybot log do you need? its really long!

  2. #2
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,484

    Default

    You could ask for help in malware removal.

    The instructions are here:
    http://forums.spybot.info/showthread.php?t=288

    Malware removal:
    http://forums.spybot.info/forumdisplay.php?f=22

  3. #3
    Junior Member
    Join Date
    Sep 2007
    Posts
    2

    Default

    Ty! I will!

  4. #4
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,484

    Default

    yw.Good luck.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •