PDA

View Full Version : Need help to remove virtumonde!!!


Joshuahuk
2007-09-10, 21:42
Here is Kasperskys results -

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, September 10, 2007 7:03:44 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 10/09/2007
Kaspersky Anti-Virus database records: 411995
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\JOSH'S~1\LOCALS~1\Temp\

Scan Statistics:
Total number of scanned objects: 27226
Number of viruses found: 8
Number of infected objects: 46
Number of suspicious objects: 0
Duration of the scan process: 00:41:43

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{C20487A8-278E-4572-8618-ECF1E8753668}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\aregkwxi.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\axuvtulg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\ddcbaya.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ha skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\EsFw32.BIN Object is locked skipped
C:\WINDOWS\system32\fesklqla.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\fomkciql.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\hervwxbu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\iclxnbbt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\ilmuslti.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\inkkdobn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\ivlbrjnn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\jyhgpphh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\jyniqilb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\kfkvonsn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\kqokyolh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\lbnyubwt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\lhfvlhxw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\llynvsar.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\mcbvacdj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\nykpoqvk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\oncymfwu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\pfkcftab.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\pjshvpja.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\pmnnn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.fl skipped
C:\WINDOWS\system32\pmnooop.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINDOWS\system32\pqlpvooq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\qgfjycqy.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\qkmnqtdn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\rxccghcs.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
C:\WINDOWS\system32\spxyjdyg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
C:\WINDOWS\system32\sshmhgav.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\ssqppml.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINDOWS\system32\svvulfqm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
C:\WINDOWS\system32\taxnyukg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\tvtywsrg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\uvoqjshw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
C:\WINDOWS\system32\vambpidc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped
C:\WINDOWS\system32\vxfwgijw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\javapi\v1.0\file\Counter.class-70f1ccc2-7b7c9cdd.class Infected: Trojan.Java.ClassLoader.i skipped
C:\WINDOWS\Temp\javapi\v1.0\jar\box.jar-735820d6-357b568f.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\WINDOWS\Temp\javapi\v1.0\jar\box.jar-735820d6-357b568f.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\WINDOWS\Temp\javapi\v1.0\jar\box.jar-735820d6-357b568f.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\WINDOWS\Temp\javapi\v1.0\jar\box.jar-735820d6-357b568f.zip ZIP: infected - 3 skipped
C:\WINDOWS\Temp\javapi\v1.0\jar\java-4939ee73-226d8e1a.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ap skipped
C:\WINDOWS\Temp\javapi\v1.0\jar\java-4939ee73-226d8e1a.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ap skipped
C:\WINDOWS\Temp\javapi\v1.0\jar\java-4939ee73-226d8e1a.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ap skipped
C:\WINDOWS\Temp\javapi\v1.0\jar\java-4939ee73-226d8e1a.zip ZIP: infected - 3 skipped
C:\WINDOWS\Temp\Perflib_Perfdata_cf4.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\DOCUME~1\JOSH'S~1\LOCALS~1\Temp\Perflib_Perfdata_248.dat Object is locked skipped

Scan process completed.

How much of the spybot log do you need? its really long!
Zenobia
2007-09-11, 04:52
You could ask for help in malware removal.

The instructions are here:
http://forums.spybot.info/showthread.php?t=288

Malware removal:
http://forums.spybot.info/forumdisplay.php?f=22
Joshuahuk
2007-09-11, 09:30
Ty! I will!
Zenobia
2007-09-12, 03:05
yw.Good luck. :)