Home > General > Pop-Ups.Virtumonde.Help


I had to reboot in safe mode, once I was in safe mode, I reformatted an empty HDD just to be sure, then I transferred all of my files into there, Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site. scan completed successfully hidden files: 0 ************************************************** ************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(1268) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll . Use up-to-date antivirus software. http://channeltechnetwork.com/general/rogue-winantivirus-virtumonde.html

Please post the contents of both log.txt and info.txt in your next reply.NEXTPlease download GMER and unzip it to your Desktop. <>Open the program and click on the Rootkit tab.Make sure BLEEPINGCOMPUTER NEEDS YOUR HELP! And thanks again! :-) GeneralKeys View Public Profile Find all posts by GeneralKeys #11 October 1st, 2009, 07:38 PM GeneralKeys Senior Member Join Date: Apr 2007 O/S: Windows Back to top #4 Kevin54C Kevin54C Topic Starter Members 4 posts OFFLINE Local time:03:31 PM Posted 12 April 2009 - 02:47 AM Anyone out there to help? http://www.bleepingcomputer.com/forums/t/218518/pop-upsvirtumondehelp/

Users are normally targeted by false positives, fake alerts, and warning of infections on their computer. We apologize for the delay; our helpers have been very busy.If you have not received help after 3 days, please CLICK HERE, and post a link to your log and the This infection is normally detectable by users receiving popups when they use the Internet. Music Jukebox\ymetray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun

Click Save to save the log file and then the log will open in notepad. This family uses advanced defensive and stealth techniques to escape detection and to hinder removal. And everytime I shut down, a window pops up, prompting me to 'End Now' to run32.dll Edited by Kevin54C, 11 April 2009 - 05:09 AM. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:19:40 AM, on 12/06/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\system32\fCRLcbbA.dll C:\WINDOWS\system32\nnnmkkLd.dll C:\WINDOWS\system32\nbyyjwuo.dll C:\WINDOWS\system32\udkthapu.dll Return Register now! If we have ever helped you in the past, please consider helping us.

Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! If there's anything that you don't understand, ask your question(s) before moving on with the fixes. --------------------------------------------------------------------------------------------- Download combofix from here **Save it directly to your desktop** Double click on combofix.exe I right-clicked that process and went to "Open File Location", and found so many strange named extensions. Jun 11, 2008 #3 Blind Dragon TS Evangelist Posts: 3,908 Remove bad HijackThis entries Run HijackThis Click on the System Scan Only button Put a check beside all of the items

  1. Just to be sure.
  2. Please consider donating to help support the continued prompt and excellent services of this site.
  3. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  4. Post that log in your next reply Warning: Do not mouseclick combofix's window whilst it's running.
  5. Any help is greatly appreciated.
  6. Login _ Social Sharing Find TechSpot on...
  7. Malwarebytes' Anti-Malware found no infected entries which puzzles me.
  8. Yet it reappears again next reboot, which frustrates me.

Short URL to this thread: https://techguy.org/592054 Log in with Facebook Log in with Twitter Log in with Google Your name or email address: Do you already have an account? http://www.spywareinfoforum.com/topic/109933-help-with-ie-pop-ups-virtumondevundo/ If not, try the free Trend Micro Clean Up Tools (http://free.antivirus.com/clean-up-tools/), like HijackThis or HouseCall. I know you guys are busy though. Avoid downloading pirated software.

Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll O2 - BHO: Skype If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. Try our mobile theme. If anyone here knows a REAL solution to this problem, PLEASE HELP ME OUT!

I'm really sad to see my hours drained away because of a single virus, thank you for trying to help me. here it is... Site Changelog Community Forum Software by IP.Board Sign In Use Facebook Use Twitter Need an account? You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

It might be someone hacking you. Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Gizmo Project\mDNSResponder.exe O23 - Service: CleanService - Unknown owner - C:\PROGRA~1\STOMPS~1\DIGITA~1\CleanService.exe Double click combofix.exe & follow the prompts.3.

Click on the "Configure" button on the bottom right.

Back to top #3 screen317 screen317 SWI Sentinel Global Moderator 8,813 posts Posted 16 December 2007 - 03:45 AM Hello piiop, and welcome to SWI.My apologies for the delay; we're all Staff Online Now Triple6 Moderator Couriant Trusted Advisor Macboatmaster Trusted Advisor Advertisement Tech Support Guy Home Forums > Operating Systems > DOS/Other > Home Forums Forums Quick Links Search Forums Recent op have you found a solution yet? It will scan and then ask you to save the log.

pop-ups and virtumonde - help This is a discussion on pop-ups and virtumonde - help within the Inactive Malware Help Topics forums, part of the Tech Support Forum category. Continue to follow the rest of the prompts from there. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized Copy (Ctrl+A then Ctrl+C) and paste I dont see any links or anything.

Password Register FAQ Calendar Today's Active Topics Search Notices Viewing on a mobile device? When completed, a log will open in Notepad. http://www.zshare.net/download/6636997424aa9350/ I zipped it! Problem 2) Web Browser Pop ups Problem 3) AVG Antispyware reports Name: Adware.Virumonde Location: C:\Windows\System32\efcdbaw.dll Risk: Medium AVG reccomends Ignore , I leave AVG at ignore, since it advises me to

Windows Defender found nothing :( Reformat. Similar Topics Virtumonde infection Aug 10, 2008 Hardcore Virtumonde Infection May 14, 2008 Particularly Nasty Virtumonde Infection Jan 5, 2008 Help with probable Virtumonde infection Jul 29, 2008 Possible virtumonde Infection Double-click mbam-setup and follow the prompts to install the program. iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast!

Yep thats what I normally do if all other methods failed in trying to remove the Virus/Trojan or whatever.. Newer Than: Search this thread only Search this forum only Display results as threads Useful Searches Recent Posts More... Zipped: http://www.zshare.net/download/6636997424aa9350/ I tried the command but it didnt work! Protect yourself against social engineering attacks.

wait for it.. They use diverse methods of installation that often includes multiple components.   Virtumonde may use a dropper/downloader component that may be detected as one of the following: TrojanDropper:Win32/Virtumonde.A TrojanDropper:Win32/Virtumonde.B TrojanDownloader:Win32/Virtumonde   (For additional detail on Virtumonde's downloading Here's the latest HJThis log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:23:10 AM, on 12/12/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16544)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Common Files\AOL\1140062540\ee\AOLSoftware.exeC:\Program Files\Java\jre1.6.0_03\bin\jusched.exeC:\Program I'm really sad to see my hours drained away because of a single virus, thank you for trying to help me.

Cookiegal, Jul 6, 2007 #3 Cookiegal Administrator Malware Specialist Coordinator Joined: Aug 27, 2003 Messages: 105,556 We were posting at the same time.