PDA

View Full Version : Another Virtumonde problem...



ChiolasPT
2009-09-06, 17:59
Greetings

My Spybot S&D detects Virtumonde on my computer, the strangest thing is that the trojan seems "inactive" at the moment (i.e: it doesn't open 200 pages of Firefox nor constantly and annoyingly refreshes IE) and it only "activates" after I play an online FPS game (I'm not sure I can say the name :lip: ), is it even possible that it only becomes active after I play? :confused:

Programs I've used:

Spybot S&D: Detects Virtumonde but doesn't fix it (even with reboot)

VundoFix: It doesn't detect Virtumonde (but I suspect it "temporarily fixes" it, that's why I'm writing this message on the infected computer lol)

AdAware: Detected several spywares and removed them all, but none named Virtumonde

SUPERAntispyware: Same as AdAware...

As I said, Spybot S&D still detects Virtumonde, however my internet connection is fine (I can even use Firefox again yay!)

So, is it a fake trojan? Is it "inactive"? How can I remove it?

The HijackThis scan log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:27, on 05-09-2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Steam\steam.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.spybot.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tsunami.pt
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1627580B-381F-4559-A366-DD7105901F59} - (no file)
O2 - BHO: (no name) - {187B9613-1CA1-4E9B-A607-C6A50CB6FCC4} - (no file)
O2 - BHO: (no name) - {26E8E5E7-B9ED-4ABB-B33A-35B4BBA9EAA9} - (no file)
O2 - BHO: (no name) - {2727BFF6-11EB-4D3B-A851-F469DA3776E1} - (no file)
O2 - BHO: (no name) - {29A7D4C0-6EB1-4B35-9D12-A48904947F23} - (no file)
O2 - BHO: (no name) - {2A098A87-801C-43AD-BC11-DFEE81600D10} - (no file)
O2 - BHO: (no name) - {329676CE-632E-45A9-B21A-70CA67569788} - (no file)
O2 - BHO: (no name) - {372B15D9-B139-4681-86B3-65C55805362F} - (no file)
O2 - BHO: (no name) - {37EF21A1-0241-4C9B-A5F7-FAE8264CAD81} - (no file)
O2 - BHO: (no name) - {3B50B0B7-07AA-4A14-8BE2-BF1DE1304855} - (no file)
O2 - BHO: (no name) - {3C749B6B-C8F5-40AC-BB12-657051C9EDB1} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {45B6BFFE-EB9F-4DAA-A8D2-B6CDCF6085DA} - (no file)
O2 - BHO: (no name) - {4E253DEF-C5C9-45BA-A365-F88187D219FF} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {568CE01B-19F5-422D-9007-C75AB3022B1A} - (no file)
O2 - BHO: (no name) - {58D13F1A-1412-4C2E-AE5D-99FDDC922826} - (no file)
O2 - BHO: (no name) - {631EB93B-E6A0-418B-9254-8A1D9EA7E1EF} - (no file)
O2 - BHO: (no name) - {68D6FC53-B4AC-4E82-A58C-F01B8B5F08C4} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {87EFFCA7-3328-414D-BED4-AB072D01662F} - (no file)
O2 - BHO: (no name) - {899E0B1B-23FB-47FA-80C1-B0A3F72C2607} - (no file)
O2 - BHO: Programa Auxiliar de Início de Sessão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9CEF3A52-9E84-417D-A53B-E296D48DC93B} - (no file)
O2 - BHO: (no name) - {9F7CB0E6-ADAE-4322-815B-A2522055B52A} - (no file)
O2 - BHO: (no name) - {9F8EFEA3-BE95-4282-BE8C-E417EAC3259E} - (no file)
O2 - BHO: (no name) - {AA9F9D0F-EBD7-4842-9306-44192AF3FA63} - (no file)
O2 - BHO: (no name) - {AC30EBC4-E521-4D9E-8D5B-742A61F95082} - (no file)
O2 - BHO: (no name) - {AC6F8B7E-E6E8-44F1-BC62-4066B369594E} - (no file)
O2 - BHO: (no name) - {B0A99475-30E8-4A6A-83A2-1E8D22E381F0} - (no file)
O2 - BHO: (no name) - {B210EB84-B7D2-493D-9BC5-17CF3BC3DB7A} - (no file)
O2 - BHO: (no name) - {B22B8BF9-108E-4BB7-93F3-882F65EF7CA4} - (no file)
O2 - BHO: (no name) - {B44C79F6-BDAC-4FAE-8074-E70396EB9B0E} - (no file)
O2 - BHO: (no name) - {B938621E-4324-4146-86E9-026D491C6DD9} - (no file)
O2 - BHO: (no name) - {C826356C-F360-4E9A-81E9-81CA817DEE77} - (no file)
O2 - BHO: (no name) - {D6491941-8C66-4651-9C59-5A108D11E75A} - (no file)
O2 - BHO: (no name) - {D941895F-9E2A-4150-9325-EEBC04EDFE37} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E844CFEA-3520-498B-B73F-21C051D5225E} - (no file)
O2 - BHO: (no name) - {F400EEB0-9C7E-4597-8E08-EC4610D94D4F} - (no file)
O2 - BHO: (no name) - {F9A0FF48-AB74-4240-B2BF-2D526F96062F} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [0cda3ea9] rundll32.exe "C:\Users\RICARD~1\AppData\Local\Temp\xmsuafwy.dll",b
O4 - HKCU\..\Run: [BM0fe90d35] Rundll32.exe "C:\Users\RICARD~1\AppData\Local\Temp\kexjdesr.dll",s
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RunSteam] C:\Program Files\Steam\Steamstart.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Serviço de rede')
O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GameSpotDownloadManager_Win32.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Serviço iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 10137 bytes


Please help me :sad:

ChiolasPT
2009-09-06, 23:46
Update:

Yeah, it really has nothing to do with the online game :P

A while ago I was watching a movie on the internet and Firefox started to send me back to my homepage every 2 seconds, now it has stopped and everything is back to normal

Now that I think of it, on the other times Virtumonde didn't opened porn, it just redirected me to my homepage and refreshed it like crazy, so maybe it's not Virtumonde at all (Spybot still says I'm infected with Virtumonde anyway...)

ChiolasPT
2009-09-07, 00:18
It was hardware problem afterall, fixed.