Donation Goal 
Donate Now Goal amount for this year: 799 USD, Received: 100 USD (13%)
Please donate to help support this website. The funds will be used to purchase owned license of LiteSpeed Web Server Enterprise (2-CPU). It provides superior performance in terms of raw speed, scalability and anti-DDoS capabilities.

Results 1 to 8 of 8

Thread: virtumond

  1. 06-08-2009 #1
    Firstmate
    Firstmate is offline
    Experienced User
    Points: 11,970, Level: 71
    Level completed: 80%, Points required for next Level: 80
    Overall activity: 0.5%
    Achievements:
    31 days registered3 months registered1 year registeredVeteran100 Experience Points
    Firstmate's Avatar
    Join Date
    Jun 2007
    Posts
    259
    Liked
    0 times

    virtumond

    I seem to have a plethora of viruses making their presence lately =(
    I have seen avast shoot warnings back and forth of things such as: reader_s, svchost.exe:ext.exe, and now some virtumond thing from spybot.

    Please help!
    Reply With Quote Reply With Quote
  2. 06-08-2009 #2
    prashanthpai
    prashanthpai is offline
    Experienced User
    Points: 14,118, Level: 77
    Level completed: 17%, Points required for next Level: 332
    Overall activity: 0.5%
    Achievements:
    Recommendation Second Class31 days registered3 months registered100 Experience PointsTagger Second Class
    prashanthpai's Avatar
    Join Date
    Feb 2008
    Location
    Socket LGA 771
    Posts
    1,962
    Liked
    3 times
    http://www.raymond.cc/blog/archives/...istrib-object/
    Happy To Help
    Reply With Quote Reply With Quote
  3. 06-09-2009 #3
    evilfantasy
    evilfantasy is offline
    Malware Removal Expert
    Points: 4,684, Level: 43
    Level completed: 67%, Points required for next Level: 66
    Overall activity: 2.0%
    Achievements:
    31 days registered3 months registered1 year registered100 Experience Points500 Experience Points
    evilfantasy's Avatar
    Join Date
    Oct 2008
    Location
    Tulsa, OK
    Posts
    383
    Liked
    0 times
    reader_s is Virut. http://www.threatexpert.com/files/reader_s.exe.html

    Your best chance at removal is the Dr Web Live CD.
    Reply With Quote Reply With Quote
  4. 06-09-2009 #4
    sidorak95
    sidorak95 is offline
    Newbie
    Points: 3,103, Level: 34
    Level completed: 36%, Points required for next Level: 97
    Overall activity: 0.5%
    Achievements:
    31 days registered3 months registered1 year registered100 Experience Points500 Experience Points
    sidorak95's Avatar
    Join Date
    May 2009
    Location
    USA
    Posts
    54
    Liked
    0 times
    To remove virut:
    http://remove-malware.com/antimalwar...t-sooooo-evil/
    Reply With Quote Reply With Quote
  5. 06-09-2009 #5
    evilfantasy
    evilfantasy is offline
    Malware Removal Expert
    Points: 4,684, Level: 43
    Level completed: 67%, Points required for next Level: 66
    Overall activity: 2.0%
    Achievements:
    31 days registered3 months registered1 year registered100 Experience Points500 Experience Points
    evilfantasy's Avatar
    Join Date
    Oct 2008
    Location
    Tulsa, OK
    Posts
    383
    Liked
    0 times
    UBCD4WIN might work because like the Dr Web LiveCD it is Linux based so you are not using many Windows files that need to be repaired. Dr. Web CureIt! *usually won't work.
    Reply With Quote Reply With Quote
  6. 06-10-2009 #6
    Firstmate
    Firstmate is offline
    Experienced User
    Points: 11,970, Level: 71
    Level completed: 80%, Points required for next Level: 80
    Overall activity: 0.5%
    Achievements:
    31 days registered3 months registered1 year registeredVeteran100 Experience Points
    Firstmate's Avatar
    Join Date
    Jun 2007
    Posts
    259
    Liked
    0 times
    This virus was on my home pc. I ran everything but the livecd.
    I'm on my laptop atm, and when i try to ping lets say google.com it doesn't work. Are the two problems related?

    To be sure, here's a hijack log from both puters.

    Laptop:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:20:40 PM, on 6/9/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0013)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\program files\steam\steam.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Launchy\Launchy.exe
    C:\Program Files\No-IP\DUC20.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Administrator\Desktop\putty.exe
    C:\Program Files\NetBeans 6.5\bin\netbeans.exe
    C:\Program Files\NetBeans 6.5\platform9\lib\nbexec.exe
    C:\Program Files\NetBeans 6.5\platform9\lib\nbexec.exe
    C:\Program Files\Java\jdk1.6.0_12\jre\bin\java.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
    F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\system32\svchost.exe"
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\WINDOWS\system32\svchost.exe",
    O1 - Hosts: 69.112.40.206 game03.xgenstudios.com
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [settings] C:\WINDOWS\system32\svchost.exe
    O4 - HKCU\..\Run: [RegCom32] C:\WINDOWS\system32\svchost.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Policies\Explorer\Run: [settings] C:\WINDOWS\system32\svchost.exe
    O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
    O4 - S-1-5-18 Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe (User 'Default user')
    O4 - Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe
    O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll (file missing)
    O20 - AppInit_DLLs: prio.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

    --
    End of file - 8657 bytes
    PC: http://pastebin.com/m5ea419eb
    (Have to pastebin cause of limit)
    Reply With Quote Reply With Quote
  7. 06-12-2009 #7
    Firstmate
    Firstmate is offline
    Experienced User
    Points: 11,970, Level: 71
    Level completed: 80%, Points required for next Level: 80
    Overall activity: 0.5%
    Achievements:
    31 days registered3 months registered1 year registeredVeteran100 Experience Points
    Firstmate's Avatar
    Join Date
    Jun 2007
    Posts
    259
    Liked
    0 times
    Dr. Web LiveCD doesn't load. I burned it on a computer that is not infected. I get an error when it's loading modules:

    Cannot find CD.
    /bin/sh: can't access tty; job control turned off.

    I can longer boot normally into the computer, the blue screen comes up.
    Reply With Quote Reply With Quote
  8. 06-13-2009 #8
    hellnoire
    hellnoire is offline
    *nix Technical Support
    Points: 25,110, Level: 95
    Level completed: 76%, Points required for next Level: 240
    Overall activity: 18.0%
    Achievements:
    Recommendation Second Class31 days registered3 months registered1 year registeredTagger Second Class     Awards:
    Frequent Poster
    hellnoire's Avatar
    Join Date
    Jan 2009
    Location
    /home/hellnoire
    Posts
    10,231
    Liked
    293 times
    Try burning the Kaspersky Live CD and using that. I never had issues with it but loads with Doctor Web.
    pacman -Syyu life not found in sync db
    Reply With Quote Reply With Quote
 

 
« Best Security | The best Antivirus Suite »
All times are GMT +8. The time now is 01:02 AM.