navbar
+ Reply to Thread
Results 1 to 8 of 8

Thread: virtumond

  1. 06-08-2009 #1
    Firstmate's Avatar
    Firstmate
    Firstmate is offline Senior Techie
    Points: 5,300, Level: 46
    Level completed: 75%, Points required for next Level: 50
    Overall activity: 0%
    Achievements:
    7 days registered31 days registered3 months registered1 year registered100 Experience Points
    Join Date
    Jun 2007
    Posts
    258
    Points
    5,300
    Level
    46

    virtumond

    I seem to have a plethora of viruses making their presence lately =(
    I have seen avast shoot warnings back and forth of things such as: reader_s, svchost.exe:ext.exe, and now some virtumond thing from spybot.

    Please help!
    Reply With Quote Reply With Quote
  2. Google Advertisement
    Join Date
    Always
    Posts
    Many
  3. 06-08-2009 #2
    prashanthpai's Avatar
    prashanthpai
    prashanthpai is offline Tech God
    Points: 8,585, Level: 62
    Level completed: 45%, Points required for next Level: 165
    Overall activity: 0%
    Achievements:
    Recommendation Second Class7 days registered31 days registered3 months registered1 year registered
    Join Date
    Feb 2008
    Location
    Socket LGA 771
    Posts
    1,975
    Points
    8,585
    Level
    62
    http://www.raymond.cc/blog/archives/...istrib-object/
    Happy To Help
    Reply With Quote Reply With Quote
  4. 06-09-2009 #3
    evilfantasy's Avatar
    evilfantasy
    evilfantasy is offline Malware Removal Expert
    Points: 2,611, Level: 31
    Level completed: 8%, Points required for next Level: 139
    Overall activity: 0%
    Achievements:
    7 days registered31 days registered3 months registered1 year registered100 Experience Points
    Join Date
    Oct 2008
    Location
    Tulsa, OK
    Posts
    376
    Points
    2,611
    Level
    31
    reader_s is Virut. http://www.threatexpert.com/files/reader_s.exe.html

    Your best chance at removal is the Dr Web Live CD.
    Reply With Quote Reply With Quote
  5. 06-09-2009 #4
    sidorak95's Avatar
    sidorak95
    sidorak95 is offline Newbie
    Points: 1,392, Level: 20
    Level completed: 92%, Points required for next Level: 8
    Overall activity: 0%
    Achievements:
    7 days registered31 days registered3 months registered1 year registered100 Experience Points
    Join Date
    May 2009
    Location
    USA
    Posts
    53
    Points
    1,392
    Level
    20
    To remove virut:
    http://remove-malware.com/antimalwar...t-sooooo-evil/
    Reply With Quote Reply With Quote
  6. 06-09-2009 #5
    evilfantasy's Avatar
    evilfantasy
    evilfantasy is offline Malware Removal Expert
    Points: 2,611, Level: 31
    Level completed: 8%, Points required for next Level: 139
    Overall activity: 0%
    Achievements:
    7 days registered31 days registered3 months registered1 year registered100 Experience Points
    Join Date
    Oct 2008
    Location
    Tulsa, OK
    Posts
    376
    Points
    2,611
    Level
    31
    UBCD4WIN might work because like the Dr Web LiveCD it is Linux based so you are not using many Windows files that need to be repaired. Dr. Web CureIt! *usually won't work.
    Reply With Quote Reply With Quote
  7. 06-10-2009 #6
    Firstmate's Avatar
    Firstmate
    Firstmate is offline Senior Techie
    Points: 5,300, Level: 46
    Level completed: 75%, Points required for next Level: 50
    Overall activity: 0%
    Achievements:
    7 days registered31 days registered3 months registered1 year registered100 Experience Points
    Join Date
    Jun 2007
    Posts
    258
    Points
    5,300
    Level
    46
    This virus was on my home pc. I ran everything but the livecd.
    I'm on my laptop atm, and when i try to ping lets say google.com it doesn't work. Are the two problems related?

    To be sure, here's a hijack log from both puters.

    Laptop:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:20:40 PM, on 6/9/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0013)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\program files\steam\steam.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Launchy\Launchy.exe
    C:\Program Files\No-IP\DUC20.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Administrator\Desktop\putty.exe
    C:\Program Files\NetBeans 6.5\bin\netbeans.exe
    C:\Program Files\NetBeans 6.5\platform9\lib\nbexec.exe
    C:\Program Files\NetBeans 6.5\platform9\lib\nbexec.exe
    C:\Program Files\Java\jdk1.6.0_12\jre\bin\java.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
    F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\system32\svchost.exe"
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\WINDOWS\system32\svchost.exe",
    O1 - Hosts: 69.112.40.206 game03.xgenstudios.com
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [settings] C:\WINDOWS\system32\svchost.exe
    O4 - HKCU\..\Run: [RegCom32] C:\WINDOWS\system32\svchost.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Policies\Explorer\Run: [settings] C:\WINDOWS\system32\svchost.exe
    O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
    O4 - S-1-5-18 Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe (User 'Default user')
    O4 - Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe
    O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll (file missing)
    O20 - AppInit_DLLs: prio.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

    --
    End of file - 8657 bytes
    PC: http://pastebin.com/m5ea419eb
    (Have to pastebin cause of limit)
    Reply With Quote Reply With Quote
  8. 06-12-2009 #7
    Firstmate's Avatar
    Firstmate
    Firstmate is offline Senior Techie
    Points: 5,300, Level: 46
    Level completed: 75%, Points required for next Level: 50
    Overall activity: 0%
    Achievements:
    7 days registered31 days registered3 months registered1 year registered100 Experience Points
    Join Date
    Jun 2007
    Posts
    258
    Points
    5,300
    Level
    46
    Dr. Web LiveCD doesn't load. I burned it on a computer that is not infected. I get an error when it's loading modules:

    Cannot find CD.
    /bin/sh: can't access tty; job control turned off.

    I can longer boot normally into the computer, the blue screen comes up.
    Reply With Quote Reply With Quote
  9. 06-13-2009 #8
    hellnoire's Avatar
    hellnoire
    hellnoire is offline Linux & Windows Guru
    Points: 25,121, Level: 95
    Level completed: 78%, Points required for next Level: 229
    Overall activity: 55.0%
    Achievements:
    Recommendation Second Class7 days registered31 days registered3 months registered1 year registeredTagger Second Class100 Experience Points250 Experience Points500 Experience Points1000 Experience Points     Awards:
    Frequent Poster
    Join Date
    Jan 2009
    Location
    The Moon, so I may play among the stars.
    Posts
    7,989
    Points
    25,121
    Level
    95
    Try burning the Kaspersky Live CD and using that. I never had issues with it but loads with Doctor Web.
    To err is human... to really foul up requires the root password. - Wise Linux Guru
    Reply With Quote Reply With Quote
« Best Security | The best Antivirus Suite »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Forum Rules

Afrikaans Albanian Arabic Belarusian Bulgarian Catalan Chinese Croatian Czech Danish Dutch English Estonian Filipino Finnish French Galician German Greek Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Korean Latvian Lithuanian Macedonian Malay Maltese Norwegian Persian Polish Portuguese Romanian Russian Serbian Slovak Slovenian Spanish Swahili Swedish Taiwanese Thai Turkish Ukrainian Vietnamese Welsh Yiddish