Help with a (posible) Virtumonde infected computer

[AltimaWeapon]

Here are the scanner results

File: wscntfy.exe2
Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: b2718ec9dc738e915d4177498e92bc4d
Packers detected: -

Scanner results
Scan taken on 14 Nov 2008 21:34:47 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
G DATA Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing


File: wscntfy.exe1
Status: OK
MD5: 9c90a6dbe5d43e189f199172675d6312
Packers detected: -

Scanner results
Scan taken on 14 Nov 2008 21:32:43 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
G DATA Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

File: wscntfy.exe3
Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: b2718ec9dc738e915d4177498e92bc4d
Packers detected: -

Scanner results
Scan taken on 14 Nov 2008 21:36:37 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
G DATA Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing


File: WSCNTFY.EXE-1B24F5EB.pf
Status: OK
MD5: ca3c7d21a3a668b0ec248033b056edf9
Packers detected: -

Scanner results
Scan taken on 14 Nov 2008 21:38:18 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
G DATA Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

 

[Shaba]

In which folder those were originally?

 

[AltimaWeapon]

Thats the problem, i cant remeber. And now it seems i cant use Windows update

 

[Shaba]

I see.

Copy one of those to C:\Windows\System32 and rename it to original name.

Let me know if it helped.

 

[AltimaWeapon]

I did it, but it wont let me use microsoft update. It says that it cant enter the page Error 0x80070424, when i try to update

 

[Shaba]

See here and post back if it helped

 

[AltimaWeapon]

Yep, it worked, thank you vey much

 

[Shaba]

Great

Still some issues left?

 

[Shaba]

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.