virtumonde smitfraud remnant help pls

[joeblunt]

Hey folks. I've mostly removed the traces of virtumonde and smitfraud using vundo smitfraudfix ccleaner in safe mode. Online ca scan comes up clean. Am concerned that my AVG software may have become compromised. Spybot keeps coming up with bots from time to time as I use my pc.

There is a reappearing rundll startup call:
[icq.com] rundll32.exe "C:\WINDOWS\system32\tahwvorw.dll",forkonce

I'm attaching my scanner HJ log and installed programs list.

Any help you can provide would be real swell!!

[tashi]

Hello.

Please see the stickied procedure for this forum: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Copy/paste only the logs requested, into a new topic, I will close this one as helpers look for zero response.

[joeblunt]

Hey folks. I've mostly removed the traces of virtumonde and smitfraud using vundo smitfraudfix ccleaner in safe mode. Online ca scan comes up clean. Am concerned that my AVG software may have become compromised. Spybot keeps coming up with bots from time to time as I use my pc.

There is a reappearing rundll startup call:
[icq.com] rundll32.exe "C:\WINDOWS\system32\tahwvorw.dll",forkonce

Any help you can provide would be real swell!!

Tashi: I've run through the before you post steps so pls keep my thread open.

[tashi]

Hello.

Please see the stickied procedure for this forum: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Copy/paste only the logs requested, into a new topic, I will close this one as helpers look for zero response.


Please do not start another topic just to say you will be posting. ;)

Thanks.

[joeblunt]

Please do not start another topic just to say you will be posting. ;)

Thanks.

I started a new topic to ask for help as you indicated that any threads with a reply were overlooked. I'm doing my best to follow your rules. Please help me by helping me get help.

Thanks, Joe

[joeblunt]

I've mostly removed the traces of virtumonde and smitfraud using vundo smitfraudfix ccleaner in safe mode. Online ca scan comes up clean. Spybot keeps coming up with bots from time to time as I use my pc. Safe mode scans and fixes work for awhile and then the stuff just comes back.

There is a reappearing rundll startup call:
[icq.com] rundll32.exe "C:\WINDOWS\system32\tahwvorw.dll",forkonce

Please help.

[tashi]

I'm doing my best to follow your rules. Please help me by helping me get help.
"BEFORE you POST"(READ this Procedure before Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)


When the scan is finished, the "Scan" button will change into a "Save Log" button.
Click that, save the log somewhere, and copy/paste (http://www.webmasternow.com/copyandpaste.html) (no attachments) into your (Click --> ) own new topic (http://forums.spybot.info/newthread.php?do=newthread&f=22)
a) The HJT log
b) The on-line Anti Virus scan log/report


Once you have done that, a helper can assist you when available. Thanks.

[joeblunt]

Thanks, will do!