TheTechGuide Forum

General Category => Tech Clinic => Topic started by: wormit on July 12, 2010, 04:46:24 AM

Title: Virtumonde.sci? cant remove
Post by: wormit on July 12, 2010, 04:46:24 AM

I ran a spybot s&d full system scan and it found this trojan (i'm assuming a trojan) called virtumonde sci. There were three files and it stated that it is unable to remove the 2 hkey files. The third file was cleanup!/jccatch.dll and i think it was fixed. I scanned my laptop with malwarebytes and superantispyware but those two didnt ditect the trojan. Should i be worried?

I tried to run the HJT to get a report but it says my pc wont allow it? I am confused with what its asking me to do to enable access. It says "for some reason your system denied write access to the Hosts file. If any Hijacked domains are in this file, Hijackthis may not be able to fix this." It says i should right click on HJT and select run as administrator since i have windows vista. But theres no function like that when i right click it!
Guestolo could u pls help?

Title: Virtumonde.sci? cant remove
Post by: guestolo on July 12, 2010, 09:00:34 AM

Could you supply the following, let's take a deeper look
Download DDS and save it to your desktop from [color="#FF0000"]here[/color] (http://"http://download.bleepingcomputer.com/sUBs/dds.scr")
Disable any script blocker,
Run dds.scr
NOTE: If your running Vista then right  click  on dds.scr and choose to "Run as Admin"
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop. Post them back to this topic.

Title: Virtumonde.sci? cant remove
Post by: wormit on July 12, 2010, 06:01:49 PM

thanks for ur reply guestolo.

Below is my DDS log


DDS (Ver_10-03-17.01) - NTFSx86  
Run by Wormit at  8:15:18.44 on Tue 13/07/2010
Internet Explorer: 8.0.6001.18928
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.61.1033.18.1915.798 [GMT 9.5:30]

AV: Windows Live OneCare *On-access scanning enabled* (Updated)   {427ADFC3-B354-4A51-BE34-A9D4218E45C4}
SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Live OneCare *enabled* (Updated) {CC7E50BA-BA8C-4DDE-B5AC-EA53BC38D01B}
FW: Windows Live OneCare Firewall *enabled*   {A3899D22-27E6-4A7E-AE4E-2C106646DAAB}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\CleanUp!\flashget.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Wormit\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - c:\program files\cleanup!\jccatch.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4128.1656\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_82E8758A37DCD509.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\cleanup!\getflash.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
uRun: [Sidebar]
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [NDSTray.exe] NDSTray.exe
mRun: [cfFncEnabler.exe] cfFncEnabler.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun: [Camera Assistant Software] "c:\program files\camera assistant software for toshiba\traybar.exe" /start
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [OneCareUI] "c:\program files\microsoft windows onecare live\winssnotify.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Share-to-Web Namespace Daemon] c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe
mRun: [Skytel] Skytel.exe
mRun: [Flashget] "c:\program files\cleanup!\FlashGet.exe" /min
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Download All with FlashGet - c:\program files\cleanup!\jc_all.htm
IE: &Download with FlashGet - c:\program files\cleanup!\jc_link.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\cleanup!\FlashGet.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 AFS;AFS;c:\windows\system32\drivers\AFS.SYS [2009-9-16 77004]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2010-5-22 28552]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-20 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-6 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-20 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-20 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-20 56816]
R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2008-4-17 40960]
R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\microsoft windows onecare live\OcHealthMon.exe [2009-7-9 26104]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-5-24 1153368]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-7-25 7168]
R3 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-7-7 53168]
R3 NETw5v32;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\drivers\NETw5v32.sys [2008-7-12 3658752]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\toshiba\smartfacev\SmartFaceVWatchSrv.exe [2008-4-24 73728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-4-19 30192]
S3 TaurusUsb;Prolink ADSL Modem USB Service;c:\windows\system32\drivers\torususb.sys [2009-6-16 542893]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-07-12 09:18:59   0   d-----w-   c:\program files\Trend Micro
2010-07-09 09:39:24   90112   ----a-w-   c:\windows\unvise32.exe
2010-07-09 09:39:16   0   d-----w-   C:\Skunk Studios
2010-06-30 09:48:22   0   d-----w-   c:\program files\BLOX Forever Trial
2010-06-30 09:45:15   0   d-----w-   c:\program files\Electrotank
2010-06-26 11:24:18   0   d-----w-   c:\programdata\Symantec
2010-06-26 11:24:18   0   d-----w-   c:\programdata\Norton
2010-06-26 11:24:13   0   d-----w-   c:\programdata\NortonInstaller
2010-06-24 00:25:57   99176   ----a-w-   c:\windows\system32\PresentationHostProxy.dll
2010-06-24 00:25:57   297808   ----a-w-   c:\windows\system32\mscoree.dll
2010-06-24 00:25:57   295264   ----a-w-   c:\windows\system32\PresentationHost.exe
2010-06-24 00:25:55   49472   ----a-w-   c:\windows\system32\netfxperf.dll
2010-06-24 00:25:55   1130824   ----a-w-   c:\windows\system32\dfshim.dll
2010-06-22 23:28:32   28672   ----a-w-   c:\windows\system32\Apphlpdm.dll
2010-06-22 23:28:31   4240384   ----a-w-   c:\windows\system32\GameUXLegacyGDFs.dll

==================== Find3M  ====================

2010-06-03 02:41:44   3600384   ----a-w-   c:\windows\system32\GPhotos.scr
2010-05-26 17:06:41   34304   ----a-w-   c:\windows\system32\atmlib.dll
2010-05-26 14:47:41   289792   ----a-w-   c:\windows\system32\atmfd.dll
2010-05-04 05:59:21   916480   ----a-w-   c:\windows\system32\wininet.dll
2010-05-04 05:55:42   71680   ----a-w-   c:\windows\system32\iesetup.dll
2010-05-04 05:55:42   109056   ----a-w-   c:\windows\system32\iesysprep.dll
2010-05-04 04:31:05   133632   ----a-w-   c:\windows\system32\ieUnatt.exe
2010-05-01 14:13:48   2037248   ----a-w-   c:\windows\system32\win32k.sys
2010-04-30 02:59:00   98504   ----a-w-   c:\windows\fonts\consola.ttf
2010-04-23 14:13:55   2048   ----a-w-   c:\windows\system32\tzres.dll
2010-03-06 04:45:22   51200   ----a-w-   c:\windows\inf\infpub.dat
2010-03-06 04:45:22   143360   ----a-w-   c:\windows\inf\infstrng.dat
2010-03-06 04:45:19   86016   ----a-w-   c:\windows\inf\infstor.dat
2010-01-10 04:11:28   665600   ----a-w-   c:\windows\inf\drvindex.dat
2008-01-21 02:43:21   174   --sha-w-   c:\program files\desktop.ini
2006-11-02 12:42:02   30674   ----a-w-   c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02   30674   ----a-w-   c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02   287440   ----a-w-   c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02   287440   ----a-w-   c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21   287440   ----a-w-   c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21   287440   ----a-w-   c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19   30674   ----a-w-   c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19   30674   ----a-w-   c:\windows\inf\perflib\0000\perfc.dat
2010-03-06 02:28:41   16384   --sha-w-   c:\windows\serviceprofiles\localservice\appdata\local\temp\cookies\index.dat
2010-03-06 02:28:41   16384   --sha-w-   c:\windows\serviceprofiles\localservice\appdata\local\temp\history\history.ie5\index.dat
2010-03-06 02:28:41   32768   --sha-w-   c:\windows\serviceprofiles\localservice\appdata\local\temp\temporary internet files\content.ie5\index.dat
2010-03-26 05:10:25   245760   --sha-w-   c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-10-16 08:49:15   245760   --sha-w-   c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH:  8:16:44.67 ===============


 I have attached the other log

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 20/04/2009 5:53:34 AM
System Uptime: 13/07/2010 7:44:32 AM (1 hours ago)

Motherboard: TOSHIBA |  | Portable PC
Processor: Intel(R) Core(TM)2 Duo CPU     T5900  @ 2.20GHz | CPU | 800/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 288 GiB total, 190.743 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================


==== Installed Programs ======================

2007 Microsoft Office system
3 Mobile Broadband
Activation Assistant for the 2007 Microsoft Office suites
Adobe Acrobat 4.0
Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.2
Adobe Shockwave Player 11.5
µTorrent
Avira AntiVir Personal - Free Antivirus
Binverse
BLOX Forever Free Trial
Business Contact Manager for Outlook 2007 SP2
Camera Assistant Software for Toshiba
CD/DVD Drive Acoustic Silencer
Citrix XenApp Web Plugin
CleanUp!
DVD MovieFactory for TOSHIBA
Electrotank Fruit Smash
Electrotank Trick or Treat Smash
FlashGet 1.9.6.1073
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)
Google Desktop
Google Earth
Google Toolbar for Internet Explorer
GTOneCare
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Memories Disc
HP Photo and Imaging 2.1 - Scanjet 2400 Series
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Java Auto Updater
Java(TM) 6 Update 20
Java(TM) 6 Update 6
Macromedia Dreamweaver 8
Macromedia Extension Manager
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Word MUI (English) 2007
Microsoft Protection Service
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Windows Live OneCare Resources v2.5.2900.28
Microsoft Windows OneCare Live AntiSpyware and AntiVirus
Microsoft Windows OneCare Live v2.5.2900.24 Idcrl Install
Microsoft Windows OneCare Live v2.5.2900.28
Microsoft XML Parser
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Nikon Message Center
OGA Notifier 2.0.0048.0
Panda ActiveScan 2.0
Picasa 3
PictureProject
Prolink H8600 ADSL Modem
PX Engine
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office Publisher 2007 (KB982124)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB982135)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
ShareIns
SPSS 15.0 for Windows Evaluation Version
Spybot - Search & Destroy
SpywareBlaster 4.3
SUPERAntiSpyware Free Edition
Sveerz
Synaptics Pointing Device Driver
TOSHIBA Assist
TOSHIBA ConfigFree
TOSHIBA Disc Creator
TOSHIBA DVD PLAYER
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Face Recognition
TOSHIBA Hardware Setup
TOSHIBA Recovery Disc Creator
TOSHIBA Software Modem
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb983486)
Windows Live OneCare
Windows Media Encoder 9 Series
WinRAR archiver
Yahoo! Software Update
Yahoo! Toolbar
Yahoo!7 Messenger

==== End Of File ===========================

Title: Virtumonde.sci? cant remove
Post by: guestolo on July 16, 2010, 10:11:28 PM

Very sorry for the delay, are you still in need of a hand?

Title: Virtumonde.sci? cant remove
Post by: wormit on July 16, 2010, 10:46:00 PM

[quote name='guestolo' date='17 July 2010 - 10:11 AM' timestamp='1279336288' post='470722']
Very sorry for the delay, are you still in need of a hand?
[/quote]

Yes, could u please check my logs and let me know whether i need to change anything?

Title: Virtumonde.sci? cant remove
Post by: guestolo on July 16, 2010, 11:19:40 PM

What parts of Windows Live Onecare do you have installed and running on this computer?
From my understanding it comes with Firewall/AntiVirus/AntiSpyware
Are all components running?

Because I do also see Avira installed

Also, I see Utorrent running on startup, do you need it running on startup?

Let's see that log from Spybot
Can you check for Updates with Spybot, run it's scan, when done
Right click on the results pane and save a log and post it's finding back here

Title: Virtumonde.sci? cant remove
Post by: wormit on July 17, 2010, 01:05:00 AM

i ran the scan and spybot didnt find any viruses so i guess everything must be back to normal now. Thanks anyway guestolo

By the way, Firewall/AntiVirus/AntiSpyware are all running.
In regards to windows liveonecare, its still running but it has expired

Title: Virtumonde.sci? cant remove
Post by: guestolo on July 17, 2010, 11:23:34 AM

Quote

Also, I see Utorrent running on startup, do you need it running on startup?

That's your option to have it running on startup, do you need it set that way?
I believe it installs that way by default

Not a great idea to have more than one Active AV or Firewall software running
Since Windows Live Onecare is expired, and no longer supported I would uninstall it
But let's do it in certain steps

Are you ready to do some updating and removal of unneeded software?

Title: Virtumonde.sci? cant remove
Post by: wormit on July 17, 2010, 10:05:53 PM

[quote name='guestolo' date='17 July 2010 - 11:23 PM' timestamp='1279383814' post='470741']Also, I see Utorrent running on startup, do you need it running on startup?[/quote]
I dont use it any more so might as well uninstall it yeah?


[quote name='guestolo' date='17 July 2010 - 11:23 PM' timestamp='1279383814' post='470741']
Are you ready to do some updating and removal of unneeded software?
[/quote]
Ok, sure.

Title: Virtumonde.sci? cant remove
Post by: guestolo on July 18, 2010, 11:00:20 PM

Let's please disable Spybot's TeaTimer, so it won't interfere with any fixes we try
You can reeable it after we're done here
Open Spybot and click on Mode in the top toolbar and check Advanced Mode
Check yes to next window.
Click on Tools in bottom left hand corner.
Click on Resident icon.
Uncheck Teatimer box.
Click Allow Change box if prompted
Close Spybot
Reboot the computer
Back in windows

Quote

I dont use it any more so might as well uninstall it yeah?

You are talking about Utorrent, so please right click it's icon by your clock and close it out
Then access Windows Control Panel>>Programs and Features>>Uninstall Utorrent
Let's also uninstall your current version of Adobe Reader as it's outdated and insecure
Close down All browser windows, then Uninstall Adobe Reader 8.1.2

Leave Avira AntiVirus installed
Next: As Windows Live OneCare will be longer supported, and is out of date, follow these instructions to remove it
To uninstall Windows Live OneCare from Vista:

   1. Click the Vista Orb, then click Control Panel.
   2. Click Programs and Features.
   3. In the Uninstall or change a program list, click Windows Live OneCare, and proceed with the uninstall.

Note that part of the uninstall will ask you to provide a reason for removing OneCare.

If Windows Live OneCare does not uninstall as expected, download the Windows Live OneCare cleanup utility -  http://social.microsoft.com/forums/en-US/onecareinstallandactivate/thread/399071e2-49dc-4767-932d-d261e3965943/  and follow the program instructions to completely uninstall.

Note
You will be prompted to restart your computer. You must restart your computer in order to completely uninstall Windows Live OneCare.

When that's done, and you have finished rebooting
Ensure that the Windows Firewall is running
Open Windows Firewall by clicking the Start button >> clicking Control Panel, clicking Security, and then clicking Windows  Firewall.

If you would rather use a Firewall that is more hands on, and gives you more control
You can try the free one from OUTPOST, your option, or continue using the one built into Vista, but don't use both
http://free.agnitum.com/

let's get Adobe Reader updated
Go to the following link
http://get.adobe.com/reader/

UNTICK the option to also install McAfee Security Scan and/or Google toolbar or similiar
Download and save to desktop the installer for the latest version of A. Reader
Right click on the installer and choose to "Run as Administrator"
After successfully installing, you can delete the installer on desktop
Can you open Adobe Reader and click on HELP>>CHECK FOR UPDATES and install any update if found to ensure you are right up to date

Come back here and let me know how things are now running please

Title: Virtumonde.sci? cant remove
Post by: wormit on July 20, 2010, 06:17:05 AM

Hey guestolo, sorry for the delay. I did everything u asked me to. Except the adobe reader installed on it self without me having to save it on to my desktop. Hope that's ok?

Everything seems to be running smoothly so far. A bit confused as to whether i did the right thing by turning off windows firewall and installing the OUTPOST one.

And also my taskbar shows windows defender in grey with a yellow exclamation mark on it. It wasnt there before. Does any thing need to be changed in this regard?