Virtumonde

[mattbald]

Hopefully someone out there is able to help. One of or PC's appears to be infected with Virtumonde.

I am running Spybot 1.6.0.31 on Windows XP Sp2.

Tere is no apparent issues with the PC, but Spybot is picking up that there is 2 registry keys that are infected.
1-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Help Objects\{number}

2-
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{number}

I have tried simply deleting the keys, but they re-appear with a new number at the end.

Let me know if you need me to post any HJT (or anything else) logs, or if you need any further info.

Any help is greatly appeciated.

Matt

 

[tashi]

Hi there,

Let me know if you need me to post any HJT (or anything else) logs, or if you need any further info.

In order for one of our volunteer helpers to advise you when available, please follow the procedure in this sticky:

"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

Start a new topic providing the HJT log, I will close this one as helpers look for threads without a response.

Regards.