Virtumonde

[Mauro]

I had on my computer virtumonde trojan and PWS.LDPinchIE; I run Spybot, and it succesfully deleted them, but after a while something opened this page(seems e-Bay, also if the address is different), tried to modify the registry (I made some screenshot, see here, here and here), and to open a connection to Internet (http://img219.imageshack.us/img219/7415/connectionwo2.jpg).
I run again Spybot, and... virtumonde was again there (screenshot of Spybot). How can I delete it?
I also have not clear if I have to give or deny the permission to modify registry, when under "Voce" there is "Spybot".

 

[Shaba]

Hi Mauro

Click here to download HJTInstall.exe

• Save HJTInstall.exe to your desktop.
• Doubleclick on the HJTInstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
• DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

 

[Shaba]

Due to the lack of feedback this Topic is closed.

If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send a private message (pm). A valid, working link to the closed topic is required.

Everyone else please begin a New Topic.