Infected with Virtumonde and smitfraud-C

Printable View

2008-11-23, 18:51
toofan

Infected with Virtumonde and smitfraud-C

friends .This is the result I get when I scan my pc using spybot s&d. I remove the entries but every time they return back. I am in trouble help.

Quote:

Smitfraud-C.: [SBI $99619F8C] Settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-1644491937-1303643608-725345543-1003\Software\Microsoft\instkey

Virtumonde: [SBI $4D2BC948] Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim

Virtumonde: [SBI $779C9C0D] Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP

Virtumonde: [SBI $FD08B4B7] Configuration file (File, fixed)
C:\WINDOWS\system32\uvDNmnpo.ini2

Virtumonde: [SBI $2A2DCEAC] Configuration file (File, fixed)
C:\WINDOWS\system32\uvDNmnpo.ini
2008-11-24, 04:11
toofan

No help yet. guy every time I connect to web this virtumonde tries to change the registries but spybot stops them by giving me a warning.
2008-11-28, 17:04
Blade81

Hi toofan

I think you missed
BEFORE you POST
(READ this Procedure BEFORE Requesting Assistance) :)

Download and install TrendMicro HijackThis
* Once installed open HijackThis by clicking Start > Programs > HijackThis and click the button labeled
Do a system scan only

* Click the scan button in the lower left hand corner of the interface and HijackThis will quickly scan your system.
* Once the scan is complete the scan button will now read save log. Click this button to save the log file to your PC. Once you select where you would like to save the file it will open in your systems default text editor. Typically this application is Notepad. Post the log here.